Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 19:23
Behavioral task
behavioral1
Sample
2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe
-
Size
31KB
-
MD5
2d889cc99d992cb6cb478b76f9dbecea
-
SHA1
0aba963b4b23e523fd036d5d3e6edfb7f1786cbc
-
SHA256
5103bbe8915dfb5d5b58067c3112582b7c8eb710e0dcfd720a79a99370b23df9
-
SHA512
b21e21a976684e55bc68a65366957f78788b6d1b8d79d8a0e9d2d9e6710962953fd4c62995e9ba7e3eed5ea8fc7202c83558e49edaf262c36bfc871f719eb233
-
SSDEEP
768:zfoixqZOlQQ/a30oDNg0jMmVoas78Kuyfv:zfvxqZ4QQSE3gV9Suy
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Windows\\system\\csrss.exe" csrss.exe -
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/2728-8-0x0000000000400000-0x000000000040F000-memory.dmp modiloader_stage2 behavioral1/files/0x000c000000012272-6.dat modiloader_stage2 behavioral1/memory/1076-10-0x0000000000400000-0x000000000040F000-memory.dmp modiloader_stage2 behavioral1/memory/1076-21-0x0000000000400000-0x000000000040F000-memory.dmp modiloader_stage2 behavioral1/memory/1076-22-0x0000000000400000-0x000000000040F000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1076 csrss.exe -
Loads dropped DLL 2 IoCs
pid Process 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\csrss.exe 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe File opened for modification C:\Windows\system\csrss.exe 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 1076 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe 30 PID 2728 wrote to memory of 1076 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe 30 PID 2728 wrote to memory of 1076 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe 30 PID 2728 wrote to memory of 1076 2728 2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d889cc99d992cb6cb478b76f9dbecea_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system\csrss.exe"C:\Windows\system\csrss.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD52d889cc99d992cb6cb478b76f9dbecea
SHA10aba963b4b23e523fd036d5d3e6edfb7f1786cbc
SHA2565103bbe8915dfb5d5b58067c3112582b7c8eb710e0dcfd720a79a99370b23df9
SHA512b21e21a976684e55bc68a65366957f78788b6d1b8d79d8a0e9d2d9e6710962953fd4c62995e9ba7e3eed5ea8fc7202c83558e49edaf262c36bfc871f719eb233