Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
-
Size
26KB
-
MD5
045895abd848515146daaf3ea428876b
-
SHA1
84339921ec00c677546751fe8454bf21ff0590b8
-
SHA256
a077911f7042889fae62c9672dc02a71d735f2d236dcac2266c8d4b8c3ff72a3
-
SHA512
43400134852504acf2a86b737ab197d11a1911b315ca1f20946ddb1ed5ce0b1bdf1073d262b91c2f3ff684eb5b909595938a57f948f8e03b45a3f6ac8d652cfd
-
SSDEEP
384:YKoA0iaVZAszu/RQ+mLyvXYu5+z0zd9F4q5Mwww3+ozHpnVCd0aXIEal4ejDUgKv:3oTHupC2/kOdv48M+3+IHpVCdFnQ9i
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2068-15-0x0000000000400000-0x0000000000424000-memory.dmp modiloader_stage2 behavioral1/memory/2228-16-0x0000000000400000-0x0000000000424000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2068 winow.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\winow.dll winow.exe File created C:\Windows\winow.exe winow.exe File created C:\Windows\winow.dll 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File created C:\Windows\winow.exe 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File opened for modification C:\Windows\winow.exe 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File opened for modification C:\Windows\winow.dll 045895abd848515146daaf3ea428876b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2068 2228 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 28 PID 2228 wrote to memory of 2068 2228 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 28 PID 2228 wrote to memory of 2068 2228 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 28 PID 2228 wrote to memory of 2068 2228 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\045895abd848515146daaf3ea428876b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045895abd848515146daaf3ea428876b_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\winow.exeC:\Windows\winow.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2068
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5742bb899fb65783d283eab9a36d5026a
SHA192e80439b3384a6a1de099dac2f5cd6938739f6f
SHA2560f8a9fb80e7a60e5d4b5b04e47b4e98002f6d5e9a234eb533f72753bce5ecb36
SHA5122cc495eb3f860300912254454597dfde2cb8dda6b3ed2ff99f7f902709d38eb296beb3d026d844b857d7135cad72aadb79147d7d3066dc4c628c1ccace688684
-
Filesize
26KB
MD5045895abd848515146daaf3ea428876b
SHA184339921ec00c677546751fe8454bf21ff0590b8
SHA256a077911f7042889fae62c9672dc02a71d735f2d236dcac2266c8d4b8c3ff72a3
SHA51243400134852504acf2a86b737ab197d11a1911b315ca1f20946ddb1ed5ce0b1bdf1073d262b91c2f3ff684eb5b909595938a57f948f8e03b45a3f6ac8d652cfd