Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 13:39

General

  • Target

    67cc43879da57fc5c76c9d31190fb12d_JaffaCakes118.exe

  • Size

    284KB

  • MD5

    67cc43879da57fc5c76c9d31190fb12d

  • SHA1

    387d7f6808f3e9ebf7acd99803eb8889c9b27406

  • SHA256

    a1321bf7ae0e8e1c9cef32d2fb24d72e2179c0a0c83590a95268d10af6f5b4de

  • SHA512

    da70b4051c482b67012c861b965125066653c5122573f9f57202211d3532cb3e55d7b6cff060f5421b50cb7feadbe13eff549e0b4394f1043d016e59433ecfe1

  • SSDEEP

    6144:qs0MDkLyqr0B/AHVy5xHgN2uv1Nsq+uIyA6Y5XdhB0S/RTYKbc:SMgyqXVIxHs2OHbIyA6Y5thB0mpYf

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67cc43879da57fc5c76c9d31190fb12d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\67cc43879da57fc5c76c9d31190fb12d_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:2316

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2448-0-0x0000000000400000-0x0000000000550200-memory.dmp

      Filesize

      1.3MB

    • memory/2448-1-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2448-2-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2448-3-0x0000000000400000-0x0000000000550200-memory.dmp

      Filesize

      1.3MB

    • memory/2448-4-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2448-6-0x0000000000400000-0x0000000000550200-memory.dmp

      Filesize

      1.3MB