Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 13:39

General

  • Target

    ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe

  • Size

    291KB

  • MD5

    ea1ca36dc6059533ed49def396d86311

  • SHA1

    6dd6a2f7ace1ead7b0bb4ecc695f97ec8b621e4b

  • SHA256

    c56e5555cd7fb723c4fea7878fc15134adc0f2b57dc2cef80317d9eedad38f27

  • SHA512

    be716243fc937afd42935e677a904a659f250ffc602f9e7d6d15bc275328ff8e8afda9d568c974c4cad04bdd24bf68220d01186fdaab95311fe894736dcd1b4c

  • SSDEEP

    6144:Wp0sbQ+xJ5vYXj1zULIPtIibYl2YLtDW76HHo9Uhh8veCzxMJGbC45:Tsbz5ej9ULIPtIibYdD06nWUhmVzx

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3720
    • C:\Program Files\360Safe.exe
      "C:\Program Files\360Safe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files\SetupDel.bat""
      2⤵
        PID:2328
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\360Safe.exe

        Filesize

        291KB

        MD5

        ea1ca36dc6059533ed49def396d86311

        SHA1

        6dd6a2f7ace1ead7b0bb4ecc695f97ec8b621e4b

        SHA256

        c56e5555cd7fb723c4fea7878fc15134adc0f2b57dc2cef80317d9eedad38f27

        SHA512

        be716243fc937afd42935e677a904a659f250ffc602f9e7d6d15bc275328ff8e8afda9d568c974c4cad04bdd24bf68220d01186fdaab95311fe894736dcd1b4c

      • C:\Program Files\SetupDel.bat

        Filesize

        212B

        MD5

        17fbac1d80e102c207f9a04685f478ba

        SHA1

        a5d0193c743a543a7748e01f8ce183d3ef68bcac

        SHA256

        749636eee018f7ad324f43337867dea1fde12e2ac7b50c666b2ee1643a79ff76

        SHA512

        1677c97a20acd9946a28eee7e6558b114e3b1cf3356e11bb60ab4345b39d8ea7f18896d1af12411258369f6f1818f4de78cf5c25e9acc334baf6d0d4cea1703f

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        791c953dc08344d984806c877877efa7

        SHA1

        ffedf29a7c11bc153baefae839b4eb0e3df63609

        SHA256

        b4a79c0846bcf023a7b6bda17778e1b431d2ba0cef78cf5caac7161aa74253fa

        SHA512

        d157f9580ffd0a875643225ba70f45da3eee115ccb6828e5faa1d87616c7a324f592c365cee1e00bd00679a84dc6ee7dc8d349288e2cfc4f0c814cfc6ad588b4

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        92da0401a2d4db6a432f657fb042855c

        SHA1

        947a5dbb5b5de4e6a013cf2900aeaf99102d6747

        SHA256

        08585230df25c76c656ca7003f20177189a5f7706c3b6f0bb8d76024e5468f62

        SHA512

        21cf74173f168ade932044baee594a31dd1c72d02f048bd7f772e0af89325d687f6da5aa54e8e29f2bd2ff39021b4733a81876b1dd5f7e9ef6960077d198ebb2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • memory/3720-16-0x0000000000400000-0x000000000054A000-memory.dmp

        Filesize

        1.3MB

      • memory/3720-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

      • memory/3720-2-0x00000000007F0000-0x00000000007F1000-memory.dmp

        Filesize

        4KB

      • memory/3720-0-0x0000000000400000-0x000000000054A000-memory.dmp

        Filesize

        1.3MB

      • memory/3828-11-0x00000000007D0000-0x000000000091A000-memory.dmp

        Filesize

        1.3MB

      • memory/4876-10-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/4876-15-0x0000000000400000-0x000000000054A000-memory.dmp

        Filesize

        1.3MB

      • memory/4876-12-0x0000000000400000-0x000000000054A000-memory.dmp

        Filesize

        1.3MB

      • memory/4876-9-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

      • memory/4876-8-0x0000000000400000-0x000000000054A000-memory.dmp

        Filesize

        1.3MB