Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11/12/2024, 20:58
General
-
Target
e3319a681968a8ae69692d69bf3b0f3e_JaffaCakes118.exe
-
Size
311KB
-
MD5
e3319a681968a8ae69692d69bf3b0f3e
-
SHA1
6ebd34638a3c4a23048f127184451329c0230a42
-
SHA256
c5d1220fd04ceff244ad21b37d2b81042866af55cdf4628e79a4e6b88ff05811
-
SHA512
967ff2a52a2e6c1fbd93a078d98e0b9abbe1e839bf2a8c0796bc3774e23efbd3e3d88311348ae5d0ca4c93e7bca8462b4a6363c9692e62312a8b5c74f408d1e8
-
SSDEEP
6144:GA96zRDy/LCRrCwOlM79pHZ3igHz8Xgv7UQY57U7pI8CyAoTHV42aK8lF0:lg9c2r79/78Xgv7UQY5KWyNTy2S
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3319a681968a8ae69692d69bf3b0f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3319a681968a8ae69692d69bf3b0f3e_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB