Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe
-
Size
291KB
-
MD5
ea1ca36dc6059533ed49def396d86311
-
SHA1
6dd6a2f7ace1ead7b0bb4ecc695f97ec8b621e4b
-
SHA256
c56e5555cd7fb723c4fea7878fc15134adc0f2b57dc2cef80317d9eedad38f27
-
SHA512
be716243fc937afd42935e677a904a659f250ffc602f9e7d6d15bc275328ff8e8afda9d568c974c4cad04bdd24bf68220d01186fdaab95311fe894736dcd1b4c
-
SSDEEP
6144:Wp0sbQ+xJ5vYXj1zULIPtIibYl2YLtDW76HHo9Uhh8veCzxMJGbC45:Tsbz5ej9ULIPtIibYdD06nWUhmVzx
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/memory/4876-12-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 behavioral2/memory/4876-15-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 behavioral2/memory/3720-16-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 4876 360Safe.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4876 set thread context of 3828 4876 360Safe.exe 95 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\360Safe.exe ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe File opened for modification C:\Program Files\360Safe.exe ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe File created C:\Program Files\SetupDel.bat ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1903077572" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099523" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31099523" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419434958" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1903077572" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9C0F9044-F676-11EE-B9F7-D65EEEF40ABB} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099523" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1947921747" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3828 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3828 IEXPLORE.EXE 3828 IEXPLORE.EXE 412 IEXPLORE.EXE 412 IEXPLORE.EXE 412 IEXPLORE.EXE 412 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3720 wrote to memory of 4876 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 94 PID 3720 wrote to memory of 4876 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 94 PID 3720 wrote to memory of 4876 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 94 PID 4876 wrote to memory of 3828 4876 360Safe.exe 95 PID 4876 wrote to memory of 3828 4876 360Safe.exe 95 PID 4876 wrote to memory of 3828 4876 360Safe.exe 95 PID 3720 wrote to memory of 2328 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 96 PID 3720 wrote to memory of 2328 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 96 PID 3720 wrote to memory of 2328 3720 ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe 96 PID 3828 wrote to memory of 412 3828 IEXPLORE.EXE 98 PID 3828 wrote to memory of 412 3828 IEXPLORE.EXE 98 PID 3828 wrote to memory of 412 3828 IEXPLORE.EXE 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea1ca36dc6059533ed49def396d86311_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Program Files\360Safe.exe"C:\Program Files\360Safe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3828 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:412
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\SetupDel.bat""2⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:3964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD5ea1ca36dc6059533ed49def396d86311
SHA16dd6a2f7ace1ead7b0bb4ecc695f97ec8b621e4b
SHA256c56e5555cd7fb723c4fea7878fc15134adc0f2b57dc2cef80317d9eedad38f27
SHA512be716243fc937afd42935e677a904a659f250ffc602f9e7d6d15bc275328ff8e8afda9d568c974c4cad04bdd24bf68220d01186fdaab95311fe894736dcd1b4c
-
Filesize
212B
MD517fbac1d80e102c207f9a04685f478ba
SHA1a5d0193c743a543a7748e01f8ce183d3ef68bcac
SHA256749636eee018f7ad324f43337867dea1fde12e2ac7b50c666b2ee1643a79ff76
SHA5121677c97a20acd9946a28eee7e6558b114e3b1cf3356e11bb60ab4345b39d8ea7f18896d1af12411258369f6f1818f4de78cf5c25e9acc334baf6d0d4cea1703f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5791c953dc08344d984806c877877efa7
SHA1ffedf29a7c11bc153baefae839b4eb0e3df63609
SHA256b4a79c0846bcf023a7b6bda17778e1b431d2ba0cef78cf5caac7161aa74253fa
SHA512d157f9580ffd0a875643225ba70f45da3eee115ccb6828e5faa1d87616c7a324f592c365cee1e00bd00679a84dc6ee7dc8d349288e2cfc4f0c814cfc6ad588b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD592da0401a2d4db6a432f657fb042855c
SHA1947a5dbb5b5de4e6a013cf2900aeaf99102d6747
SHA25608585230df25c76c656ca7003f20177189a5f7706c3b6f0bb8d76024e5468f62
SHA51221cf74173f168ade932044baee594a31dd1c72d02f048bd7f772e0af89325d687f6da5aa54e8e29f2bd2ff39021b4733a81876b1dd5f7e9ef6960077d198ebb2
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee