Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 07:23

General

  • Target

    3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    3833d145deb51045263eecc433f72fb8

  • SHA1

    ab916eff5ec4f679e0130b5e1c8d5b8dc833b428

  • SHA256

    4320c709971fee0240c0474182b1606ad6b71dff7fe1796be34521b79c6d917f

  • SHA512

    d89a971b1dde908b9aecfec931021887ad81d62996b5ca78340829666583bc303fb419a10805241608955824ef99a828a7a883d6311989be0733d9fca79e66f8

  • SSDEEP

    1536:B71Je9+W+eXjNBDm9NAsPsFdOUC6TtgegbhcTXSbJakuwP2joHDLXaHQmPg:B7/LW55xmnEFdOkty96CN1OsHDMP

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\3833d145deb51045263eecc433f72fb8_JaffaCakes118.exe
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\rsvp32_2.dll

    Filesize

    88KB

    MD5

    766a974784977e4c4f9aef3ff9d52c7a

    SHA1

    9195373d16a505394cfef92091866c1e6dfa90b5

    SHA256

    d0a271165ddd57f07f31cc893f1fa01d35ae3bd2870a25b09883c6668ec4591e

    SHA512

    d463bfac26acf2ada5208ca1aea8355f06b9d4a1cb4e7749cd19c1a08bfc59de8711f4321ebc13eaa043b4e43947465277e07feae4c3dc154c18a2de7fa8113b

  • C:\Windows\SysWOW64\sporder.dll

    Filesize

    8KB

    MD5

    a082e5473b2a9a4d846ed7ddf637ac76

    SHA1

    1703f7969a6e76f8458eda3e8e40fd115c0bfdc3

    SHA256

    73f7171c2af70ccf8ee4c49626fb456807a6a668f6a967298dcd5ed29773bd2a

    SHA512

    abc1ea5a46d0784db23ddd9bd984527913c3e40a3896cfa43e9f4f999e4064038b24aed78e27bf2e705c8c55482e801f520987c2a74be6f01edc32df3d235eaa

  • memory/3020-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3020-3-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3020-6-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3020-11-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/4560-2-0x0000000013140000-0x000000001316D000-memory.dmp

    Filesize

    180KB