Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 16:43
Behavioral task
behavioral1
Sample
74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe
-
Size
756KB
-
MD5
74dfac0b393742f0e572e6d31fc38523
-
SHA1
690c92867d5c6d5e4fd2d444fda96863eab91bfd
-
SHA256
cb1cca8d57b74c12ad478460a2e48b92bb36814c38c935e3f4fa49c68f62a179
-
SHA512
6e140f5075315a21e36b81a2aa76ae0ce118600f80f45a3c422e769b469509f14ff445b1f8102c04ab27e038f5a5c4147cdd522d9866f1f137a50f2665a75372
-
SSDEEP
12288:7z+eiZ+oAqscfid1beffMSF6UQGDxG0RgrGgYXTe2nccK:7z+PdbidFWxIIDo0gYXTN4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral2/files/0x000100000000002b-9.dat modiloader_stage2 behavioral2/memory/2716-19-0x00000000003A0000-0x0000000000465000-memory.dmp modiloader_stage2 behavioral2/memory/64-17-0x0000000000400000-0x00000000004C5000-memory.dmp modiloader_stage2 behavioral2/memory/3924-22-0x0000000000400000-0x00000000004C5000-memory.dmp modiloader_stage2 behavioral2/memory/844-23-0x0000000000400000-0x00000000004C5000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 3924 rejoicess.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\H: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\N: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\O: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\V: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\L: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\M: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\P: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\T: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\W: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\Y: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\A: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\E: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\J: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\U: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\Z: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\G: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\I: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\K: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\Q: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\R: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\S: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened (read-only) \??\X: 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File created F:\AutoRun.inf 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoicess.exe rejoicess.exe File opened for modification C:\Windows\SysWOW64\_rejoicess.exe rejoicess.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3924 set thread context of 64 3924 rejoicess.exe 88 PID 3924 set thread context of 2716 3924 rejoicess.exe 89 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoicess.exe 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoicess.exe 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1556 64 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rejoicess.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9C61282A-4B8B-11EF-B355-5EC22215AA79} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1901395001" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121304" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31121304" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121304" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1897332445" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1897332445" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428789822" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2716 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 844 wrote to memory of 3924 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 87 PID 844 wrote to memory of 3924 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 87 PID 844 wrote to memory of 3924 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 87 PID 3924 wrote to memory of 64 3924 rejoicess.exe 88 PID 3924 wrote to memory of 64 3924 rejoicess.exe 88 PID 3924 wrote to memory of 64 3924 rejoicess.exe 88 PID 3924 wrote to memory of 64 3924 rejoicess.exe 88 PID 3924 wrote to memory of 64 3924 rejoicess.exe 88 PID 3924 wrote to memory of 2716 3924 rejoicess.exe 89 PID 3924 wrote to memory of 2716 3924 rejoicess.exe 89 PID 3924 wrote to memory of 2716 3924 rejoicess.exe 89 PID 844 wrote to memory of 3084 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 91 PID 844 wrote to memory of 3084 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 91 PID 844 wrote to memory of 3084 844 74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe 91 PID 2716 wrote to memory of 3160 2716 IEXPLORE.EXE 95 PID 2716 wrote to memory of 3160 2716 IEXPLORE.EXE 95 PID 2716 wrote to memory of 3160 2716 IEXPLORE.EXE 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74dfac0b393742f0e572e6d31fc38523_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoicess.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoicess.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:64
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 124⤵
- Program crash
PID:1556
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3160
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""2⤵
- System Location Discovery: System Language Discovery
PID:3084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 64 -ip 641⤵PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5bfeff9085f5c23b3774e8b204db86b1f
SHA1928ea670c1e2e7b948ff072ca7cbd9917c34209e
SHA256e9af96d6594c63137b9429cb452bc941d7e0848edac50be94f1c105c66a153a1
SHA512fdf7877f411c947789a3c275b7b8a31b7212f8b5cded05633baaebde2edc8dbb85d91423774ee1bb4dede7f9ce4e927fe847477628440dba9d73964c32b3e490
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
756KB
MD574dfac0b393742f0e572e6d31fc38523
SHA1690c92867d5c6d5e4fd2d444fda96863eab91bfd
SHA256cb1cca8d57b74c12ad478460a2e48b92bb36814c38c935e3f4fa49c68f62a179
SHA5126e140f5075315a21e36b81a2aa76ae0ce118600f80f45a3c422e769b469509f14ff445b1f8102c04ab27e038f5a5c4147cdd522d9866f1f137a50f2665a75372