Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2024, 15:21

General

  • Target

    b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe

  • Size

    277KB

  • MD5

    b434689b1cbd3ec1badc2d6894ba03ba

  • SHA1

    86e44f8c1e98ab44b1173820a2cc6210b294fb18

  • SHA256

    0d4df276ac210da10aa6ad75e8b130cbda829e76ce314cc48764d59f5d9d766f

  • SHA512

    70f282c7810d53e5527c8aebcb43f95c33846dc0445507cae025680bcb17bf501448a8fe08cd195e855b94aaf1ce4c40a4a9b10cd9d9ebd2aaf52caaf596d575

  • SSDEEP

    6144:foD01eZ2oAUx2NMTZq72SViOYSjagtYSTqOvSV:f4Go3SMT02wvYS5pqV

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
  • ModiLoader Second Stage 58 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b434689b1cbd3ec1badc2d6894ba03ba_JaffaCakes118.exe"
      2⤵
        PID:1960
    • C:\Windows\system32\mshta.exe
      "C:\Windows\system32\mshta.exe" javascript:bThboW4l="7qFV";S8T=new%20ActiveXObject("WScript.Shell");wA0Ihqh5="FUHPS6f";P1Iia=S8T.RegRead("HKLM\\software\\Wow6432Node\\uloK5t34\\zlWfQJc");iYvO9IAP="Nk6";eval(P1Iia);cV9Hfap0="2WZW2MUrCN";
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:cytupqk
        2⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe
          3⤵
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VirtualBox drivers on disk
          • Looks for VMWare Tools registry key
          • Checks BIOS information in registry
          • Deletes itself
          • Drops startup file
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1696
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\SysWOW64\regsvr32.exe"
            4⤵
              PID:812

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\416844\1a6bc1.983f33d

        Filesize

        42KB

        MD5

        aab40d46a7310cfadff882530acb126a

        SHA1

        7d6a6f80fc4754429d514d033459a7f4d7e71952

        SHA256

        2b99dfcf56844a5fd6892a1cca68e7cdf752c2444597d973cb43cd9adb64063d

        SHA512

        8cd794eb3ed89eea57610fbc8803b4c504faf716661760f67e93801aed1c90ff64faeddb69a845d211d6ea0204b00be730756004e5c85fcfcd320a6e81a6b9a4

      • C:\Users\Admin\AppData\Local\416844\7efaba.bat

        Filesize

        61B

        MD5

        a9d3ea542d72c3d4eb6e79b37f9b265e

        SHA1

        9ef048c6a4cc72891fe4b6d8c3ae59e134711cb9

        SHA256

        d287a2bcc9c2485a60329a6bb94fb260bec57524e3098a5bd7c7cedf3e460314

        SHA512

        eba879b158972749be9a48b1ff0d7393f69960da48c1f8e92c3886d9cf16ae437ac5eea449f59de788cbf5b9033ebc78311f2b591f6d41631521a3f0ea24208b

      • C:\Users\Admin\AppData\Local\416844\eecdc5.lnk

        Filesize

        881B

        MD5

        0b9b2889adaa01b84df3cfe6c10e0873

        SHA1

        13993bba5a8349571ebbc472c2bd74d05a4ae41d

        SHA256

        20fc72ab6ba4ee81174ed98e36399aecbe99345cdb2b098d71a896b68b3f4806

        SHA512

        04bd86fd25bdf89ebb1371d170782824426d80af99b1a7100e1ba181cc341a6a38ae5027dbb2710582e0aedb0e66d4aab0534db8bbf45adde0fff3b436ee85df

      • C:\Users\Admin\AppData\Roaming\730a4b\791dbf.983f33d

        Filesize

        38KB

        MD5

        5e436feaf5bff11338e6c2d2cc27a386

        SHA1

        e6a51ba90373c85a53e475ef2a31a8ed72b4d7bd

        SHA256

        7bb60bc2c669b1d863d458c66ebbf5f8dba994ff4ced3ad8f7bff23a8ee020b1

        SHA512

        2cce44d005ea0bddeb294de941c6cce701a198d42b12fd2b2bd2e37ed209067d60ee1993d573eb1fea2541837228bdbf201c1d92d088df2a4f5012cee5c1803e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\be0980.lnk

        Filesize

        991B

        MD5

        06e941575744568f7aec743dbf7a820a

        SHA1

        dcd052402d06c205c2a1165ef9d8d25fc568dc32

        SHA256

        d0018cd9efebd743d94c0c6ce0ecaa35bc81b61d8a722194efdfd93e5c56bf7b

        SHA512

        a8a30ec67923e5cddf0d5d3b8abfd60a63f78920d33a9bfb4b3df9aae179ee055dda77800b6f3da6edb8f99c7c31f3b1ce915c723a849e230db8765f9b0b4ba1

      • memory/812-81-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-77-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-78-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-79-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-80-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-75-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-82-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-83-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-84-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-85-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-86-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-87-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-88-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-89-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/812-76-0x00000000001E0000-0x000000000031E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-27-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-34-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-68-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-51-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-50-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-69-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-49-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-59-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-58-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-57-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-47-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-46-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-45-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-44-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-43-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-42-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-41-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-40-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-38-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-37-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-36-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-62-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-61-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-52-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-26-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-48-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-39-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-32-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-33-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-35-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-30-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1696-31-0x0000000000160000-0x000000000029E000-memory.dmp

        Filesize

        1.2MB

      • memory/1960-3-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

      • memory/1960-15-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-14-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-10-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-11-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-12-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-9-0x0000000001D00000-0x0000000001DD4000-memory.dmp

        Filesize

        848KB

      • memory/1960-8-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

      • memory/1960-7-0x0000000000400000-0x0000000000439000-memory.dmp

        Filesize

        228KB

      • memory/2596-29-0x0000000006150000-0x0000000006224000-memory.dmp

        Filesize

        848KB

      • memory/2596-28-0x0000000002CC0000-0x0000000004CC0000-memory.dmp

        Filesize

        32.0MB

      • memory/2596-24-0x0000000006150000-0x0000000006224000-memory.dmp

        Filesize

        848KB