Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 21:20 UTC
Static task
static1
Behavioral task
behavioral1
Sample
17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe
-
Size
480KB
-
MD5
17912b6fe92a6a47b414b028685c60db
-
SHA1
754b1918a98bf85cfdd925e1a50ff3de17e8b1ef
-
SHA256
5defa642588973d1f05b5727da4abe62fc4af6abc85b510a2eaf28288502e1ca
-
SHA512
4ebff1a4b24c80a0233bf42e8f84584f4cb9543e1102f95336eb5e0591b99e58dd86ac46cd6a870053161ac5712141630294c8ddcbf67aa915a4c3d77cd16ae2
-
SSDEEP
6144:J1zdTAymDA+k86XxqaCBeFndXF2idZecnl20lHRxp3gCncduD7yB9VCO6Sco4q8d:FT1jf86Xxd7F3Z4mxx9DqVTVOCLu
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1728-36-0x0000000013140000-0x00000000131C4000-memory.dmp modiloader_stage2 behavioral1/memory/2572-228-0x0000000013140000-0x00000000131C4000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2660 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2572 netservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2572 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2660 1728 17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe 29 PID 1728 wrote to memory of 2660 1728 17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe 29 PID 1728 wrote to memory of 2660 1728 17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe 29 PID 1728 wrote to memory of 2660 1728 17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe 29 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31 PID 2572 wrote to memory of 2652 2572 netservice.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\17912b6fe92a6a47b414b028685c60db_JaffaCakes118.exe"2⤵
- Deletes itself
PID:2660
-
-
C:\Users\Admin\Favorites\netservice.exeC:\Users\Admin\Favorites\netservice.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe2⤵PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD517912b6fe92a6a47b414b028685c60db
SHA1754b1918a98bf85cfdd925e1a50ff3de17e8b1ef
SHA2565defa642588973d1f05b5727da4abe62fc4af6abc85b510a2eaf28288502e1ca
SHA5124ebff1a4b24c80a0233bf42e8f84584f4cb9543e1102f95336eb5e0591b99e58dd86ac46cd6a870053161ac5712141630294c8ddcbf67aa915a4c3d77cd16ae2