Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:16

General

  • Target

    e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    e58e2d2d2fab88e1b2f8c88aca3118b9

  • SHA1

    ae561eff64f535794c266a70c8506bb10d430bbd

  • SHA256

    15ec190cd1510696b56bc112c84902c862f052d35d5eff70c9c6dec9ce99816e

  • SHA512

    c072a53c3946af6a126c87c907f790e6721617cd2830d55b77efbe944b10c3e3545c523d0bfaa8981a65058cf9272160a7920c587c3d3b987bd597f3cb9382aa

  • SSDEEP

    24576:Y3V7WvUvQp3+cNa+UyVD/YuB3l9+Du3FtAdhNDQjTj/:27DvQpNaHDu/Wu1tAdhNDQjTT

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 16 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Users\Admin\AppData\Local\Temp\12.exe
      "C:\Users\Admin\AppData\Local\Temp\12.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\msnmsgrs.exe
        "C:\Windows\msnmsgrs.exe" \melt "C:\Users\Admin\AppData\Local\Temp\12.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4548
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\12.exe

    Filesize

    273KB

    MD5

    ab03f7d12eb1c9ec8ecc1c4a50b0dcfc

    SHA1

    d5d5cde4ddb4892198ac2dae47d142313bf57aa4

    SHA256

    234a9c6dc4217c935692268a0d3b3c7f889d80463e53d9fed11965cf1f7f36f0

    SHA512

    8343608a58d12a56f9f767afbf6f69b23db6c831bc366075918d4004292cec6c030f5691bfa195aab5ba33e34fde5a158f5fe486f74d173bed569e053ffb1cb5

  • C:\Windows\cmsetac.dll

    Filesize

    33KB

    MD5

    93ccf5a58bb4999d02d085818240d0e0

    SHA1

    57dab0949efbd204a3e504717a86beca07eeb5b7

    SHA256

    a656645fd8b937fbca2f4a66889eaa31570a2a7ab7677e2384f21ae296bfa3d1

    SHA512

    6366be3b76d8896f8915488f2b4ff5555fed5991bcb509c31853ae30478bcbc4b583774c9293d091d9c3cad773cf38f7af401e2afacf208505cfb99f3982b34d

  • C:\Windows\ntdtcstp.dll

    Filesize

    7KB

    MD5

    67587e25a971a141628d7f07bd40ffa0

    SHA1

    76fcd014539a3bb247cc0b761225f68bd6055f6b

    SHA256

    e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

    SHA512

    6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

  • memory/2160-39-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2160-29-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/2392-13-0x0000000004C40000-0x0000000004C42000-memory.dmp

    Filesize

    8KB

  • memory/2392-2-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2392-10-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

    Filesize

    4KB

  • memory/2392-11-0x0000000004C70000-0x0000000004C71000-memory.dmp

    Filesize

    4KB

  • memory/2392-12-0x0000000004C60000-0x0000000004C61000-memory.dmp

    Filesize

    4KB

  • memory/2392-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2392-14-0x0000000004C50000-0x0000000004C51000-memory.dmp

    Filesize

    4KB

  • memory/2392-15-0x0000000004C00000-0x0000000004C01000-memory.dmp

    Filesize

    4KB

  • memory/2392-16-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

    Filesize

    4KB

  • memory/2392-18-0x0000000004C10000-0x0000000004C11000-memory.dmp

    Filesize

    4KB

  • memory/2392-17-0x0000000004C20000-0x0000000004C22000-memory.dmp

    Filesize

    8KB

  • memory/2392-5-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

    Filesize

    4KB

  • memory/2392-27-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

    Filesize

    4KB

  • memory/2392-28-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2392-8-0x0000000004C90000-0x0000000004C91000-memory.dmp

    Filesize

    4KB

  • memory/2392-4-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

    Filesize

    4KB

  • memory/2392-7-0x0000000004C80000-0x0000000004C81000-memory.dmp

    Filesize

    4KB

  • memory/2392-9-0x0000000004B90000-0x0000000004B91000-memory.dmp

    Filesize

    4KB

  • memory/4548-47-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/4548-67-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-54-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/4548-55-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-56-0x00000000005A0000-0x00000000005A8000-memory.dmp

    Filesize

    32KB

  • memory/4548-57-0x0000000002250000-0x000000000225E000-memory.dmp

    Filesize

    56KB

  • memory/4548-58-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-61-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-64-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-51-0x0000000002250000-0x000000000225E000-memory.dmp

    Filesize

    56KB

  • memory/4548-70-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-73-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-76-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-79-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-82-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-85-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-88-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-91-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/4548-94-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB