Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e12c47566b...18.exe

windows7-x64

10

e12c47566b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e12c47566b3b49fc80b3c26f75b50f3d_JaffaCakes118

  • Size

    176KB

  • Sample

    241211-m6kgcazmcy

  • MD5

    e12c47566b3b49fc80b3c26f75b50f3d

  • SHA1

    24979694656bf526aa3da5c776d3ac91a7e00874

  • SHA256

    dbf532759371e357703f0438bbfbbcd7c3ff52f60ac4e25aa3aa5443751a4277

  • SHA512

    21522f270211e96c3cd54a6359364a4c6d1d717c1a0947040ee3b874af1cd19abe040784f36c6d5f250d71b85b08ea58907df557e56c7ff60817216ad5b7f2ff

  • SSDEEP

    3072:2rq0PWhNJaLuxgzGwoqNGuOj3LGm3KHmc6u/gy:w3uuzGuEn34KID

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      e12c47566b3b49fc80b3c26f75b50f3d_JaffaCakes118

    • Size

      176KB

    • MD5

      e12c47566b3b49fc80b3c26f75b50f3d

    • SHA1

      24979694656bf526aa3da5c776d3ac91a7e00874

    • SHA256

      dbf532759371e357703f0438bbfbbcd7c3ff52f60ac4e25aa3aa5443751a4277

    • SHA512

      21522f270211e96c3cd54a6359364a4c6d1d717c1a0947040ee3b874af1cd19abe040784f36c6d5f250d71b85b08ea58907df557e56c7ff60817216ad5b7f2ff

    • SSDEEP

      3072:2rq0PWhNJaLuxgzGwoqNGuOj3LGm3KHmc6u/gy:w3uuzGuEn34KID

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks