Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
-
Size
160KB
-
MD5
3a6deff0c7e6d272e9e2da0be31f51dc
-
SHA1
2459a19ff18853664259a78a28f92827e3d7ad77
-
SHA256
b97cbcb5ab47b92339284cbe8f9a682b3e6d5bd3a11a4b8c05d374fc1739b3e6
-
SHA512
a75bdc5baa2ebe8b1088afb086066204a8f383a44eb8dd75991fa13f429f057f60ba2853f69359e61cac5516827c74dc6f921a1d55d4081d3a251038de2a55b2
-
SSDEEP
3072:+6JR+uNAEaC3KtYlG4tOLjzp9irclCYoVVtZ3TrqAxAcfB:+gZNATdYlG4Azp9iglJoVVtV6aB
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2156-22-0x00000000003A0000-0x00000000003C4000-memory.dmp modiloader_stage2 behavioral1/memory/2504-25-0x0000000000920000-0x0000000000944000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2156 server.exe -
Loads dropped DLL 4 IoCs
pid Process 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 2156 server.exe 2504 DllHost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2156 server.exe 2156 server.exe 2156 server.exe 2156 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2156 server.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1828 wrote to memory of 2156 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 32 PID 1828 wrote to memory of 2156 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 32 PID 1828 wrote to memory of 2156 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 32 PID 1828 wrote to memory of 2156 1828 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2156
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD562b4849714df2618ede4e969b7fa7393
SHA18261723638b238991be2d1a82ad58ab18ca68642
SHA2560267272015f6a6c540f259f31ff8c1d1400e8e3251c328b9910a26d85480c066
SHA5127d71f61801b09e6c426667d1eb7b06486cfd22127c2cce64302dcea5185c487f814db2095f3e44cf1937504cf51e61cdb459f6b8b59a82a38c9da6cd79a7c343
-
Filesize
21KB
MD5010d44afab7b20dd92f6fae3a61c3e0e
SHA1701443f703bd22a4e265d0098081699f917d2f8b
SHA2568835a7671c35f3c278fa65584020c7176847f47f1f798bbe473ed90c06b18dda
SHA512d47ebfa2faa042b1cc3d2d3694773f8327f048d843b110f76b0416c7f81566cad7733f28bb1db67bc4cb81c20125647c97956e0a0bcbe53118f94467d4605e07
-
Filesize
40KB
MD5f4a62c8f4058bb94870d9229dd1bb356
SHA1cc399d919602cc29652def89c7673fc991525450
SHA25631665d5914218c9a69097b04a4d337eb4fe1767b69c2b12304b6a842516f4021
SHA512e22b38b2e5fa62a30a1b4e51b21d984464d4a28ea5dfbaa9d60533e0cafe67113a44c46153d9c0cb2f22c26afea56b1d99651dca610986ea7c2d001f59d713cd