Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 13:25

General

  • Target

    227fbc9e0fc268c5b5bc11620f427e80_JaffaCakes118.exe

  • Size

    718KB

  • MD5

    227fbc9e0fc268c5b5bc11620f427e80

  • SHA1

    6002c7e7bd4bd693a389907292dc9332105705b7

  • SHA256

    0e692fadfb06c91d660104ada432ca3268a7c11faaccc6f7b015c47f8dea887c

  • SHA512

    d2fff028c4f51fe85eba673cc70304133421e89b01c6de26ab2b85694061aa106f19e1143e2fd53662730e6448c633c1c8c7eb2d7261e4d536494cd4aa2d0932

  • SSDEEP

    12288:ZkSFizeGD1h2bGZCS1JHT/LmC3Fo/0F3Z4mxx+DqVTVOCS:ZkxjD3pZ/prt3FosQmXNVTzS

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\227fbc9e0fc268c5b5bc11620f427e80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\227fbc9e0fc268c5b5bc11620f427e80_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
        "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\program files\internet explorer\IEXPLORE.EXE
          "C:\program files\internet explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1192
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""
        3⤵
          PID:1064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat

      Filesize

      122B

      MD5

      c6cbf263f5edd10cbc32e5ef40b33d9e

      SHA1

      0073d4bee85f70754c2f6257a32b03a72007d75b

      SHA256

      35939646786fff9edb272c0e6727827b7254419b451a3983c2fd5d7b04bafbad

      SHA512

      61a3ec28a835b9b6c1cfe0cbe8d62972cb98032dad08cf06934dea8e6d7f0d2cd237084e29b201843870ce414590c07a4a7b52819d3d733ed8d99b5387219351

    • C:\Users\Admin\AppData\Local\Temp\3.exe

      Filesize

      704KB

      MD5

      740fa7acf08a0c5fd1dd85a421591c6d

      SHA1

      34c775ef9c2405cac96a80c9d39330354fed72ef

      SHA256

      03dc94588bd318d9b8c4faddee4de0e014c69a9a18531451d8380fab49d6ac72

      SHA512

      94c29eaabac1cfc0efce08723e6863e11e1c66837c60dbc1791dbf8b583736156886ba80e2844c97b853d19ba2d079786d41514a40318202049616f13bd20567

    • memory/2700-78-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB

    • memory/3040-74-0x00000000009A0000-0x0000000000A57000-memory.dmp

      Filesize

      732KB

    • memory/4888-0-0x0000000000400000-0x000000000050B000-memory.dmp

      Filesize

      1.0MB

    • memory/4888-1-0x00000000021D0000-0x0000000002224000-memory.dmp

      Filesize

      336KB

    • memory/4888-53-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-52-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-57-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/4888-56-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/4888-55-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-54-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-51-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-50-0x00000000023A0000-0x00000000023A1000-memory.dmp

      Filesize

      4KB

    • memory/4888-49-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-48-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-47-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-46-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-45-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-44-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-43-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-42-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-41-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-40-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-39-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-38-0x0000000002470000-0x0000000002471000-memory.dmp

      Filesize

      4KB

    • memory/4888-37-0x0000000002400000-0x0000000002401000-memory.dmp

      Filesize

      4KB

    • memory/4888-36-0x0000000002410000-0x0000000002411000-memory.dmp

      Filesize

      4KB

    • memory/4888-35-0x0000000002430000-0x0000000002431000-memory.dmp

      Filesize

      4KB

    • memory/4888-34-0x0000000002460000-0x0000000002461000-memory.dmp

      Filesize

      4KB

    • memory/4888-33-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

    • memory/4888-32-0x00000000023E0000-0x00000000023E1000-memory.dmp

      Filesize

      4KB

    • memory/4888-31-0x00000000023B0000-0x00000000023B1000-memory.dmp

      Filesize

      4KB

    • memory/4888-30-0x00000000023C0000-0x00000000023C1000-memory.dmp

      Filesize

      4KB

    • memory/4888-29-0x0000000002350000-0x0000000002351000-memory.dmp

      Filesize

      4KB

    • memory/4888-28-0x0000000002360000-0x0000000002361000-memory.dmp

      Filesize

      4KB

    • memory/4888-27-0x00000000023D0000-0x00000000023D1000-memory.dmp

      Filesize

      4KB

    • memory/4888-26-0x0000000002380000-0x0000000002381000-memory.dmp

      Filesize

      4KB

    • memory/4888-25-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-24-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-23-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-22-0x0000000003340000-0x0000000003341000-memory.dmp

      Filesize

      4KB

    • memory/4888-21-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-20-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-19-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-18-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-17-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-16-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-15-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-14-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/4888-13-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-12-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-11-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-10-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-9-0x0000000003350000-0x0000000003351000-memory.dmp

      Filesize

      4KB

    • memory/4888-8-0x00000000006F0000-0x00000000006F1000-memory.dmp

      Filesize

      4KB

    • memory/4888-7-0x0000000000700000-0x0000000000701000-memory.dmp

      Filesize

      4KB

    • memory/4888-6-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/4888-5-0x00000000006A0000-0x00000000006A1000-memory.dmp

      Filesize

      4KB

    • memory/4888-4-0x0000000000A10000-0x0000000000A11000-memory.dmp

      Filesize

      4KB

    • memory/4888-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

      Filesize

      4KB

    • memory/4888-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

      Filesize

      4KB

    • memory/4888-67-0x0000000000400000-0x000000000050B000-memory.dmp

      Filesize

      1.0MB

    • memory/4888-68-0x00000000021D0000-0x0000000002224000-memory.dmp

      Filesize

      336KB

    • memory/4976-77-0x0000000000400000-0x00000000004B7000-memory.dmp

      Filesize

      732KB