Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe
-
Size
668KB
-
MD5
654b69623060b9d0994cd2c14fc5c357
-
SHA1
1226e9dd4ca8243997c7b1bbac6e1686d08d1af5
-
SHA256
f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1
-
SHA512
9ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80
-
SSDEEP
12288:fqUfin1qJm/9e/sK1RaAXPTytF3Z4mxxukly74G1TBecNQP2d6sb0:SUf4IWQ7aAXutQmXPy74GpBeDP2d660
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/memory/2472-65-0x0000000000400000-0x000000000051F000-memory.dmp modiloader_stage2 behavioral1/memory/2660-66-0x0000000000400000-0x000000000051F000-memory.dmp modiloader_stage2 behavioral1/memory/2472-80-0x0000000000400000-0x000000000051F000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2572 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 rejoice91.exe -
Loads dropped DLL 5 IoCs
pid Process 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 2904 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\N: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\O: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\V: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Y: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\G: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\H: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\I: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\L: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\P: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\S: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\T: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\A: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\J: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\K: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\M: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\X: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\E: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Q: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\R: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\U: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\W: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened (read-only) \??\Z: 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File created F:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe File opened for modification C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2660 set thread context of 2984 2660 rejoice91.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2904 2660 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2660 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 30 PID 2472 wrote to memory of 2660 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 30 PID 2472 wrote to memory of 2660 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 30 PID 2472 wrote to memory of 2660 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2984 2660 rejoice91.exe 31 PID 2660 wrote to memory of 2904 2660 rejoice91.exe 32 PID 2660 wrote to memory of 2904 2660 rejoice91.exe 32 PID 2660 wrote to memory of 2904 2660 rejoice91.exe 32 PID 2660 wrote to memory of 2904 2660 rejoice91.exe 32 PID 2472 wrote to memory of 2572 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 33 PID 2472 wrote to memory of 2572 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 33 PID 2472 wrote to memory of 2572 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 33 PID 2472 wrote to memory of 2572 2472 654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\654b69623060b9d0994cd2c14fc5c357_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 3203⤵
- Loads dropped DLL
- Program crash
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵
- Deletes itself
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5391863e7f98c58a280f4b7fd6224b35f
SHA18b16814a5557b40a919047e90c898fad0bd25e9c
SHA2565f920bfc2383adf123fd9756058aa765ca40ad8df626fb0672f2a0ddd87bec9d
SHA5123a312c02235dd9afa109f635a05e75622f02507014446817062f7f4d82270623f727b4d4a834f17e2cec95fdc35ae78c7f992376c396b8de2a4ca4c119f9a881
-
Filesize
668KB
MD5654b69623060b9d0994cd2c14fc5c357
SHA11226e9dd4ca8243997c7b1bbac6e1686d08d1af5
SHA256f5be6e5001a47d22eea6f9b4912a0142ff7cc86f075324fbb967f931fbb833b1
SHA5129ec952e27eab08916ad31d9a6fe47f988793485b033e1680976a34fefc1a3e5df8dd6ed70b54882f29ddd66703da9c0b803f43253a575ae584f2a64774f2ff80