Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
-
Size
281KB
-
MD5
ff35523562a0f9ff51ff4c17050b5220
-
SHA1
0f4ac5ca9cc5b11567140463805ebb5228fac17d
-
SHA256
fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e
-
SHA512
486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb
-
SSDEEP
6144:ZV0jzqVArhFdSEnFYtGtr6PKypSHEKoLMZDZn/m1zBNMGCl6ct:IjSGhFgEnFYtE0KA2EKooZDZn/m1PMnd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/2936-2-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral1/memory/272-16-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral1/memory/2936-32-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral1/memory/272-33-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral1/memory/2936-41-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2504 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 272 stemy.exe -
Loads dropped DLL 5 IoCs
pid Process 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 2552 WerFault.exe 2552 WerFault.exe 2552 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_stemy.exe stemy.exe File opened for modification C:\Windows\SysWOW64\_stemy.exe stemy.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 272 set thread context of 3044 272 stemy.exe 29 -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2552 272 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2936 wrote to memory of 272 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 28 PID 2936 wrote to memory of 272 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 28 PID 2936 wrote to memory of 272 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 28 PID 2936 wrote to memory of 272 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 28 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 3044 272 stemy.exe 29 PID 272 wrote to memory of 2552 272 stemy.exe 30 PID 272 wrote to memory of 2552 272 stemy.exe 30 PID 272 wrote to memory of 2552 272 stemy.exe 30 PID 272 wrote to memory of 2552 272 stemy.exe 30 PID 2936 wrote to memory of 2504 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 31 PID 2936 wrote to memory of 2504 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 31 PID 2936 wrote to memory of 2504 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 31 PID 2936 wrote to memory of 2504 2936 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 2803⤵
- Loads dropped DLL
- Program crash
PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""2⤵
- Deletes itself
PID:2504
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD56df7075b2373981ac635dee7702cdb03
SHA1928c30d640746954cfc9fd920f9756084d9d8b2c
SHA2563110640a5fdb4ee004e3a0c3c899ad4b108179a9bc76711fb78422b11d62cc86
SHA512a70f23ad1cbc00abb80207137bc5c2e02671ff9ce135a55dd44b1d62c42924f91ee332f550e51f52b9d72312a4baf0488aeca549878599688c35702962a75169
-
Filesize
281KB
MD5ff35523562a0f9ff51ff4c17050b5220
SHA10f4ac5ca9cc5b11567140463805ebb5228fac17d
SHA256fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e
SHA512486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb