Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
045895abd848515146daaf3ea428876b_JaffaCakes118.exe
-
Size
26KB
-
MD5
045895abd848515146daaf3ea428876b
-
SHA1
84339921ec00c677546751fe8454bf21ff0590b8
-
SHA256
a077911f7042889fae62c9672dc02a71d735f2d236dcac2266c8d4b8c3ff72a3
-
SHA512
43400134852504acf2a86b737ab197d11a1911b315ca1f20946ddb1ed5ce0b1bdf1073d262b91c2f3ff684eb5b909595938a57f948f8e03b45a3f6ac8d652cfd
-
SSDEEP
384:YKoA0iaVZAszu/RQ+mLyvXYu5+z0zd9F4q5Mwww3+ozHpnVCd0aXIEal4ejDUgKv:3oTHupC2/kOdv48M+3+IHpVCdFnQ9i
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/5112-16-0x0000000000400000-0x0000000000424000-memory.dmp modiloader_stage2 behavioral2/memory/4032-19-0x0000000000400000-0x0000000000424000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 4032 winow.exe -
Loads dropped DLL 2 IoCs
pid Process 4032 winow.exe 4032 winow.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\winow.dll 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File created C:\Windows\winow.dll winow.exe File created C:\Windows\winow.exe winow.exe File created C:\Windows\winow.dll 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File created C:\Windows\winow.exe 045895abd848515146daaf3ea428876b_JaffaCakes118.exe File opened for modification C:\Windows\winow.exe 045895abd848515146daaf3ea428876b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4032 winow.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4032 5112 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 91 PID 5112 wrote to memory of 4032 5112 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 91 PID 5112 wrote to memory of 4032 5112 045895abd848515146daaf3ea428876b_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\045895abd848515146daaf3ea428876b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045895abd848515146daaf3ea428876b_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\winow.exeC:\Windows\winow.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:4424
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5742bb899fb65783d283eab9a36d5026a
SHA192e80439b3384a6a1de099dac2f5cd6938739f6f
SHA2560f8a9fb80e7a60e5d4b5b04e47b4e98002f6d5e9a234eb533f72753bce5ecb36
SHA5122cc495eb3f860300912254454597dfde2cb8dda6b3ed2ff99f7f902709d38eb296beb3d026d844b857d7135cad72aadb79147d7d3066dc4c628c1ccace688684
-
Filesize
26KB
MD5045895abd848515146daaf3ea428876b
SHA184339921ec00c677546751fe8454bf21ff0590b8
SHA256a077911f7042889fae62c9672dc02a71d735f2d236dcac2266c8d4b8c3ff72a3
SHA51243400134852504acf2a86b737ab197d11a1911b315ca1f20946ddb1ed5ce0b1bdf1073d262b91c2f3ff684eb5b909595938a57f948f8e03b45a3f6ac8d652cfd