Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
-
Size
281KB
-
MD5
ff35523562a0f9ff51ff4c17050b5220
-
SHA1
0f4ac5ca9cc5b11567140463805ebb5228fac17d
-
SHA256
fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e
-
SHA512
486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb
-
SSDEEP
6144:ZV0jzqVArhFdSEnFYtGtr6PKypSHEKoLMZDZn/m1zBNMGCl6ct:IjSGhFgEnFYtE0KA2EKooZDZn/m1PMnd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/2204-2-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral2/memory/336-10-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral2/memory/336-20-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 behavioral2/memory/2204-21-0x0000000000400000-0x0000000000516200-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 336 stemy.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_stemy.exe stemy.exe File opened for modification C:\Windows\SysWOW64\_stemy.exe stemy.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 336 set thread context of 2616 336 stemy.exe 88 PID 336 set thread context of 1528 336 stemy.exe 89 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 372 2616 WerFault.exe 88 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4013150879" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101921" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4013150879" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1ACCA94F-FFD5-11EE-8A9B-6223ADA6AD33} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4016432482" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101921" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101921" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420465099" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1528 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1528 IEXPLORE.EXE 1528 IEXPLORE.EXE 3972 IEXPLORE.EXE 3972 IEXPLORE.EXE 3972 IEXPLORE.EXE 3972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2204 wrote to memory of 336 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 87 PID 2204 wrote to memory of 336 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 87 PID 2204 wrote to memory of 336 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 87 PID 336 wrote to memory of 2616 336 stemy.exe 88 PID 336 wrote to memory of 2616 336 stemy.exe 88 PID 336 wrote to memory of 2616 336 stemy.exe 88 PID 336 wrote to memory of 2616 336 stemy.exe 88 PID 336 wrote to memory of 2616 336 stemy.exe 88 PID 336 wrote to memory of 1528 336 stemy.exe 89 PID 336 wrote to memory of 1528 336 stemy.exe 89 PID 336 wrote to memory of 1528 336 stemy.exe 89 PID 2204 wrote to memory of 552 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 92 PID 2204 wrote to memory of 552 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 92 PID 2204 wrote to memory of 552 2204 ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe 92 PID 1528 wrote to memory of 3972 1528 IEXPLORE.EXE 94 PID 1528 wrote to memory of 3972 1528 IEXPLORE.EXE 94 PID 1528 wrote to memory of 3972 1528 IEXPLORE.EXE 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 244⤵
- Program crash
PID:372
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3972
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""2⤵PID:552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2616 -ip 26161⤵PID:1808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD56df7075b2373981ac635dee7702cdb03
SHA1928c30d640746954cfc9fd920f9756084d9d8b2c
SHA2563110640a5fdb4ee004e3a0c3c899ad4b108179a9bc76711fb78422b11d62cc86
SHA512a70f23ad1cbc00abb80207137bc5c2e02671ff9ce135a55dd44b1d62c42924f91ee332f550e51f52b9d72312a4baf0488aeca549878599688c35702962a75169
-
Filesize
281KB
MD5ff35523562a0f9ff51ff4c17050b5220
SHA10f4ac5ca9cc5b11567140463805ebb5228fac17d
SHA256fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e
SHA512486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee