Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 21:20 UTC

General

  • Target

    17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe

  • Size

    480KB

  • MD5

    17912b6fe92a6a47b414b028685c60db

  • SHA1

    754b1918a98bf85cfdd925e1a50ff3de17e8b1ef

  • SHA256

    5defa642588973d1f05b5727da4abe62fc4af6abc85b510a2eaf28288502e1ca

  • SHA512

    4ebff1a4b24c80a0233bf42e8f84584f4cb9543e1102f95336eb5e0591b99e58dd86ac46cd6a870053161ac5712141630294c8ddcbf67aa915a4c3d77cd16ae2

  • SSDEEP

    6144:J1zdTAymDA+k86XxqaCBeFndXF2idZecnl20lHRxp3gCncduD7yB9VCO6Sco4q8d:FT1jf86Xxd7F3Z4mxx9DqVTVOCLu

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      PID:2660
  • C:\Users\Admin\Favorites\netservice.exe
    C:\Users\Admin\Favorites\netservice.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe
      2⤵
        PID:2652

    Network

    • flag-us
      DNS
      tzlin.3322.org
      svchost.exe
      Remote address:
      8.8.8.8:53
      Request
      tzlin.3322.org
      IN A
      Response
    No results found
    • 8.8.8.8:53
      tzlin.3322.org
      dns
      svchost.exe
      60 B
      124 B
      1
      1

      DNS Request

      tzlin.3322.org

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Favorites\netservice.exe

      Filesize

      480KB

      MD5

      17912b6fe92a6a47b414b028685c60db

      SHA1

      754b1918a98bf85cfdd925e1a50ff3de17e8b1ef

      SHA256

      5defa642588973d1f05b5727da4abe62fc4af6abc85b510a2eaf28288502e1ca

      SHA512

      4ebff1a4b24c80a0233bf42e8f84584f4cb9543e1102f95336eb5e0591b99e58dd86ac46cd6a870053161ac5712141630294c8ddcbf67aa915a4c3d77cd16ae2

    • memory/1728-19-0x0000000002190000-0x0000000002191000-memory.dmp

      Filesize

      4KB

    • memory/1728-28-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/1728-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/1728-6-0x0000000001B60000-0x0000000001B61000-memory.dmp

      Filesize

      4KB

    • memory/1728-5-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/1728-18-0x00000000021A0000-0x00000000021A1000-memory.dmp

      Filesize

      4KB

    • memory/1728-3-0x0000000001B70000-0x0000000001B71000-memory.dmp

      Filesize

      4KB

    • memory/1728-2-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/1728-1-0x0000000001BC0000-0x0000000001C14000-memory.dmp

      Filesize

      336KB

    • memory/1728-26-0x0000000002250000-0x0000000002251000-memory.dmp

      Filesize

      4KB

    • memory/1728-27-0x0000000002240000-0x0000000002241000-memory.dmp

      Filesize

      4KB

    • memory/1728-25-0x00000000021E0000-0x00000000021E1000-memory.dmp

      Filesize

      4KB

    • memory/1728-24-0x00000000021F0000-0x00000000021F1000-memory.dmp

      Filesize

      4KB

    • memory/1728-23-0x0000000002210000-0x0000000002211000-memory.dmp

      Filesize

      4KB

    • memory/1728-22-0x0000000002230000-0x0000000002231000-memory.dmp

      Filesize

      4KB

    • memory/1728-21-0x0000000001E40000-0x0000000001E41000-memory.dmp

      Filesize

      4KB

    • memory/1728-20-0x00000000021C0000-0x00000000021C1000-memory.dmp

      Filesize

      4KB

    • memory/1728-0-0x0000000013140000-0x00000000131C4000-memory.dmp

      Filesize

      528KB

    • memory/1728-8-0x0000000003120000-0x0000000003121000-memory.dmp

      Filesize

      4KB

    • memory/1728-29-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/1728-4-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/1728-17-0x0000000001E20000-0x0000000001E21000-memory.dmp

      Filesize

      4KB

    • memory/1728-16-0x0000000001E30000-0x0000000001E31000-memory.dmp

      Filesize

      4KB

    • memory/1728-15-0x00000000021B0000-0x00000000021B1000-memory.dmp

      Filesize

      4KB

    • memory/1728-14-0x0000000001E50000-0x0000000001E51000-memory.dmp

      Filesize

      4KB

    • memory/1728-13-0x0000000002180000-0x0000000002181000-memory.dmp

      Filesize

      4KB

    • memory/1728-12-0x0000000003110000-0x0000000003112000-memory.dmp

      Filesize

      8KB

    • memory/1728-11-0x0000000001E00000-0x0000000001E01000-memory.dmp

      Filesize

      4KB

    • memory/1728-10-0x0000000003120000-0x0000000003121000-memory.dmp

      Filesize

      4KB

    • memory/1728-9-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/1728-37-0x0000000001BC0000-0x0000000001C14000-memory.dmp

      Filesize

      336KB

    • memory/1728-36-0x0000000013140000-0x00000000131C4000-memory.dmp

      Filesize

      528KB

    • memory/2572-33-0x0000000013140000-0x00000000131C4000-memory.dmp

      Filesize

      528KB

    • memory/2572-228-0x0000000013140000-0x00000000131C4000-memory.dmp

      Filesize

      528KB

    • memory/2652-39-0x0000000000080000-0x0000000000081000-memory.dmp

      Filesize

      4KB

    • memory/2652-45-0x00000000000A0000-0x00000000000A1000-memory.dmp

      Filesize

      4KB

    • memory/2652-54-0x00000000000C0000-0x00000000000C1000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.