Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 13:39
Behavioral task
behavioral1
Sample
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
-
Size
333KB
-
MD5
86441f2bdcebaff18508df7e7abeb8fe
-
SHA1
83bf95c9d04b2b138324487b7e84f74ba38047e8
-
SHA256
106551fca79f7aef8d903cb967cf58bcc312fb27fbadd77ec08c77dcf9effea9
-
SHA512
54f6ddca3780a82c234fa36a307a1fb7c01411bf1e14906dd192d29a20f77c88adbb9a06150ff4ac88c26ed8058b3cd6486ed0bb7ea0294eba9b1569e41cc3b5
-
SSDEEP
6144:9U1AYBg+3zBWX4oXx5UyonY4Cve6lbUCDts8NbVD7aQ1ZY/6kraVDR0o:9U1ALWzYooBubdCzJlts8Nb5OQ8SgalO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/2380-35-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 behavioral1/memory/2108-36-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 behavioral1/memory/2380-39-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 behavioral1/memory/2380-49-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2608 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2108 cookis.exe -
Loads dropped DLL 5 IoCs
pid Process 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 2424 WerFault.exe 2424 WerFault.exe 2424 WerFault.exe -
resource yara_rule behavioral1/files/0x0001000000000027-9.dat upx behavioral1/memory/2380-0-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2108-21-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2336-30-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2380-35-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2108-36-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2380-39-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral1/memory/2380-49-0x0000000000400000-0x00000000004D7000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\O: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\A: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\I: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\L: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\N: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Q: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\R: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\V: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\G: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\H: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\J: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\T: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\U: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\W: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\X: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Z: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\E: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\P: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\S: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\B: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\K: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Y: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File created F:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_cookis.exe cookis.exe File opened for modification C:\Windows\SysWOW64\_cookis.exe cookis.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2108 set thread context of 2336 2108 cookis.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2424 2108 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cookis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2108 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2108 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2108 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2108 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 30 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2336 2108 cookis.exe 31 PID 2108 wrote to memory of 2424 2108 cookis.exe 32 PID 2108 wrote to memory of 2424 2108 cookis.exe 32 PID 2108 wrote to memory of 2424 2108 cookis.exe 32 PID 2108 wrote to memory of 2424 2108 cookis.exe 32 PID 2380 wrote to memory of 2608 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 34 PID 2380 wrote to memory of 2608 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 34 PID 2380 wrote to memory of 2608 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 34 PID 2380 wrote to memory of 2608 2380 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 2803⤵
- Loads dropped DLL
- Program crash
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD56fbf342fb1f5d9024b01619736f59270
SHA1e935c410f225fa10e80976634eec5093d40b1ea8
SHA2564728f57c64042d20d7261e212f7538c543511b7dd0419eb8680531b5179f5ba2
SHA5128d201d8997bea21e95e036fd86d566899902b3c981d75d81ea1c00e3cddf638b4ea8b6ca76a9058e9da35815161bdb796454bf66ff6c8b774d236a1bb7e93f38
-
Filesize
333KB
MD586441f2bdcebaff18508df7e7abeb8fe
SHA183bf95c9d04b2b138324487b7e84f74ba38047e8
SHA256106551fca79f7aef8d903cb967cf58bcc312fb27fbadd77ec08c77dcf9effea9
SHA51254f6ddca3780a82c234fa36a307a1fb7c01411bf1e14906dd192d29a20f77c88adbb9a06150ff4ac88c26ed8058b3cd6486ed0bb7ea0294eba9b1569e41cc3b5