Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe
-
Size
160KB
-
MD5
3a6deff0c7e6d272e9e2da0be31f51dc
-
SHA1
2459a19ff18853664259a78a28f92827e3d7ad77
-
SHA256
b97cbcb5ab47b92339284cbe8f9a682b3e6d5bd3a11a4b8c05d374fc1739b3e6
-
SHA512
a75bdc5baa2ebe8b1088afb086066204a8f383a44eb8dd75991fa13f429f057f60ba2853f69359e61cac5516827c74dc6f921a1d55d4081d3a251038de2a55b2
-
SSDEEP
3072:+6JR+uNAEaC3KtYlG4tOLjzp9irclCYoVVtZ3TrqAxAcfB:+gZNATdYlG4Azp9iglJoVVtV6aB
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/644-19-0x0000000002270000-0x0000000002294000-memory.dmp modiloader_stage2 behavioral2/memory/644-21-0x0000000002270000-0x0000000002294000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 644 server.exe -
Loads dropped DLL 2 IoCs
pid Process 644 server.exe 644 server.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 644 server.exe 644 server.exe 644 server.exe 644 server.exe 644 server.exe 644 server.exe 644 server.exe 644 server.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 644 server.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2884 wrote to memory of 644 2884 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 85 PID 2884 wrote to memory of 644 2884 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 85 PID 2884 wrote to memory of 644 2884 3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a6deff0c7e6d272e9e2da0be31f51dc_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5010d44afab7b20dd92f6fae3a61c3e0e
SHA1701443f703bd22a4e265d0098081699f917d2f8b
SHA2568835a7671c35f3c278fa65584020c7176847f47f1f798bbe473ed90c06b18dda
SHA512d47ebfa2faa042b1cc3d2d3694773f8327f048d843b110f76b0416c7f81566cad7733f28bb1db67bc4cb81c20125647c97956e0a0bcbe53118f94467d4605e07
-
Filesize
40KB
MD5f4a62c8f4058bb94870d9229dd1bb356
SHA1cc399d919602cc29652def89c7673fc991525450
SHA25631665d5914218c9a69097b04a4d337eb4fe1767b69c2b12304b6a842516f4021
SHA512e22b38b2e5fa62a30a1b4e51b21d984464d4a28ea5dfbaa9d60533e0cafe67113a44c46153d9c0cb2f22c26afea56b1d99651dca610986ea7c2d001f59d713cd