Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe
-
Size
592KB
-
MD5
300b37904cf11eab88269d1acbbf9cb1
-
SHA1
c3ffc615be7c519742e7a5278703f76c6f532656
-
SHA256
33d4e1ea59a92c32b2e536ea50240b0459c386c283ce5447024efe7735987d0c
-
SHA512
eaa77b19b182f8acc80047121bfab9193edd419774de498fc35a7898a7b5f6fb1375e53ad232e171f3efa1eeee577956aa5de6994ef1fab49c36d7dd3cf92282
-
SSDEEP
12288:z1mI61tI6NHzhzxmzNgRn6+SEF3Z4mxx/2cihaebneX07x74:zUI61ttNHzvmzNU6+9QmX/2cFmnJK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral2/memory/5044-65-0x0000000000400000-0x000000000055C000-memory.dmp modiloader_stage2 behavioral2/memory/2860-80-0x0000000000400000-0x000000000055C000-memory.dmp modiloader_stage2 behavioral2/memory/5044-86-0x0000000000400000-0x000000000055C000-memory.dmp modiloader_stage2 behavioral2/memory/2860-89-0x0000000000400000-0x000000000055C000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2860 huyulai.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\Y: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\A: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\L: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\N: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\O: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\S: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\T: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\V: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\E: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\G: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\Q: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\X: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\Z: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\K: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\P: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\I: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\J: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\M: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\U: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\W: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\B: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened (read-only) \??\H: 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File created F:\AutoRun.inf 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\huyulai.exe 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\huyulai.exe 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe File created C:\Program Files\_huyulai.exe huyulai.exe File opened for modification C:\Program Files\_huyulai.exe huyulai.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2312 2860 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5044 wrote to memory of 2860 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 87 PID 5044 wrote to memory of 2860 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 87 PID 5044 wrote to memory of 2860 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 87 PID 2860 wrote to memory of 848 2860 huyulai.exe 88 PID 2860 wrote to memory of 848 2860 huyulai.exe 88 PID 5044 wrote to memory of 3968 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 92 PID 5044 wrote to memory of 3968 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 92 PID 5044 wrote to memory of 3968 5044 300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\300b37904cf11eab88269d1acbbf9cb1_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\huyulai.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\huyulai.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe"3⤵PID:848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 6843⤵
- Program crash
PID:2312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""2⤵PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2860 -ip 28601⤵PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5236e5318bac76fcd4e33147c8cf82e70
SHA107fbaed2c357465f16efa1fd325da09ea50ab763
SHA25637799c15c61191be37ecd74b4e5722ea43cee9646b9b825f62120423d7b6bd2b
SHA5124ca1eb84a5e18b4fd58c43531151b9f1f5a17f8e58dc53ddffa258b6437319e3d26d918a6b78a6649503d584906435fc82d6d1a5cbf2432dce308dd73cde5a3c
-
Filesize
592KB
MD5300b37904cf11eab88269d1acbbf9cb1
SHA1c3ffc615be7c519742e7a5278703f76c6f532656
SHA25633d4e1ea59a92c32b2e536ea50240b0459c386c283ce5447024efe7735987d0c
SHA512eaa77b19b182f8acc80047121bfab9193edd419774de498fc35a7898a7b5f6fb1375e53ad232e171f3efa1eeee577956aa5de6994ef1fab49c36d7dd3cf92282