Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 19:56
Behavioral task
behavioral1
Sample
fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe
-
Size
211KB
-
MD5
fd8603ac0863c641297e023f70d95512
-
SHA1
800d4a743740fb0d12377b0886ee29774db16f7e
-
SHA256
c6ecc38740aab40296c6fd2eedc8269ad33c569fbff2383a798dd36e6110e959
-
SHA512
1772d573872b912ca82248a55f02d0028f1b584174106f10ed758db4fc3699e52e060e76e8c1206faec549447e60d3d073637da81bbd9350f8177ce91985b041
-
SSDEEP
6144:QdeQZ+LlgkMX04uCnuRTzR03vTJr37O3Q8:+eQsBdUbvpqg
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/2324-4-0x0000000013140000-0x00000000131BB000-memory.dmp modiloader_stage2 behavioral1/memory/2588-2981-0x0000000010410000-0x0000000010478000-memory.dmp modiloader_stage2 behavioral1/memory/2588-2983-0x0000000010410000-0x0000000010478000-memory.dmp modiloader_stage2 behavioral1/memory/2588-3006-0x0000000010410000-0x0000000010478000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral1/files/0x0033000000014b18-3.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 2600 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 netservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2948 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2600 2324 fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe 29 PID 2324 wrote to memory of 2600 2324 fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe 29 PID 2324 wrote to memory of 2600 2324 fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe 29 PID 2324 wrote to memory of 2600 2324 fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe 29 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31 PID 2948 wrote to memory of 2588 2948 netservice.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\fd8603ac0863c641297e023f70d95512_JaffaCakes118.exe"2⤵
- Deletes itself
PID:2600
-
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5fd8603ac0863c641297e023f70d95512
SHA1800d4a743740fb0d12377b0886ee29774db16f7e
SHA256c6ecc38740aab40296c6fd2eedc8269ad33c569fbff2383a798dd36e6110e959
SHA5121772d573872b912ca82248a55f02d0028f1b584174106f10ed758db4fc3699e52e060e76e8c1206faec549447e60d3d073637da81bbd9350f8177ce91985b041