Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 10:12

General

  • Target

    739c8ff5ba7a51d6c8b4bdea0941b5f2_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    739c8ff5ba7a51d6c8b4bdea0941b5f2

  • SHA1

    1fc4cd29b2f949e5056c36122f160632904f2f96

  • SHA256

    2ed8e0bb83db6129bd8f02071d5f3ec10b71e5937fd730e5261aaf0e03ed03c4

  • SHA512

    b5d439d00620418980530c498f807a24d53e9b4a0a26eea8940530de7dfddd78e2bd8ab56293b86e3a5edcaa3ef3e1e030aa38ce12a59a7483a62ef676bd3ae3

  • SSDEEP

    49152:riwHeJIvILLFr/6FQ1eRemVUswa1ens9h:XI35/6FQ1wxmsqnWh

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 23 IoCs
  • Themida packer 23 IoCs

    Detects Themida, an advanced Windows software protection system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\739c8ff5ba7a51d6c8b4bdea0941b5f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\739c8ff5ba7a51d6c8b4bdea0941b5f2_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\crux_remake.ini

    Filesize

    7KB

    MD5

    4df1a8be461c9d5112cfc84a5011d7d4

    SHA1

    903d32e003a76ce28536c4f6379bb6b4d58b9258

    SHA256

    767ae67fcda96a55f3980e60de5da59f1d5c242939672a048b24eb8db18e8f9c

    SHA512

    1d7f47087bc643a13dd7df9c20eca1e06cc4b217f3908cb84ba75cd64015f038a057381de22d7773ff66831b74dc9465b9d48b3fee22e25ab1d02f294684e079

  • memory/2520-408-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-419-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-363-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-0-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2520-5-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-4-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-3-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-404-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-403-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-402-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-405-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-409-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-2-0x0000000000401000-0x0000000000455000-memory.dmp

    Filesize

    336KB

  • memory/2520-407-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-406-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2520-410-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-411-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-412-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-413-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-414-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-415-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-416-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-417-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-418-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-1-0x0000000000760000-0x000000000084E000-memory.dmp

    Filesize

    952KB

  • memory/2520-420-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB

  • memory/2520-421-0x0000000000400000-0x000000000075E000-memory.dmp

    Filesize

    3.4MB