Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 16:00

General

  • Target

    74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe

  • Size

    543KB

  • MD5

    74bc321f7ddf5c4cea5ad439ade8d944

  • SHA1

    4c3fa52416095dce153f64bf905a422498219cde

  • SHA256

    1a341b6537b59a56e455fd8800f47b3e67ccce248a12ed9d14e6b3357bac58e3

  • SHA512

    21c7354c8ae270e9bc983b919c4cbc4a099739a3b19da9b92e8e36177fa98809d758f9e946077238a5481814f56c886cf690dca8386e85320b83fc0c631d48e4

  • SSDEEP

    12288:AQ88SoZOf7DUIHa8mZgCO0JF2U/wGiOW1q0RJX5yltD:Ax8SoZOf7wc1mZgCO0/2UsOSq0NG

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 25 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\74bc321f7ddf5c4cea5ad439ade8d944_JaffaCakes118.exe
        3⤵
        • UAC bypass
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4900
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

    Filesize

    15KB

    MD5

    9a0ad6c3051a90b70118d371d0dea0bd

    SHA1

    6f7cd54930ece00ff4d97ca7d4c674c6927744b9

    SHA256

    b3825e5b259bc5436998b9791c757c569b0588b3ec04b0803dfef17b0d527a77

    SHA512

    58d5f31d06ac33f6d583957e05ffc8e8b1ba8753cd9e5be51d0acdd31b123c69cf666f5025a75cc1c7b49b88f711faa7575a18d2968f4e86e6580dbdce7f32d7

  • memory/1316-21-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1316-5-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1316-2-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4900-31-0x0000000000A60000-0x0000000000A6A000-memory.dmp

    Filesize

    40KB

  • memory/4900-35-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-9-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-18-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-15-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-22-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-8-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-28-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-29-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-30-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-13-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-32-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-34-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-11-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-36-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-38-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-40-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-42-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-44-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-46-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-48-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-50-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-52-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-54-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-56-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/4900-58-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB