Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 13:39
Behavioral task
behavioral1
Sample
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe
-
Size
333KB
-
MD5
86441f2bdcebaff18508df7e7abeb8fe
-
SHA1
83bf95c9d04b2b138324487b7e84f74ba38047e8
-
SHA256
106551fca79f7aef8d903cb967cf58bcc312fb27fbadd77ec08c77dcf9effea9
-
SHA512
54f6ddca3780a82c234fa36a307a1fb7c01411bf1e14906dd192d29a20f77c88adbb9a06150ff4ac88c26ed8058b3cd6486ed0bb7ea0294eba9b1569e41cc3b5
-
SSDEEP
6144:9U1AYBg+3zBWX4oXx5UyonY4Cve6lbUCDts8NbVD7aQ1ZY/6kraVDR0o:9U1ALWzYooBubdCzJlts8Nb5OQ8SgalO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/2056-25-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 behavioral2/memory/1724-27-0x0000000000400000-0x00000000004D7000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2056 cookis.exe -
resource yara_rule behavioral2/memory/1724-0-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/files/0x000100000000002b-10.dat upx behavioral2/memory/2056-15-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/4400-18-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/4068-21-0x0000000000CA0000-0x0000000000D77000-memory.dmp upx behavioral2/memory/2056-25-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/1724-27-0x0000000000400000-0x00000000004D7000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Q: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\S: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\B: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\E: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\N: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\R: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\H: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\J: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Y: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\U: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\W: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\K: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\L: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\M: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\O: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\P: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\T: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\A: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\I: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\Z: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\V: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened (read-only) \??\X: 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened for modification C:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File created F:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened for modification F:\AutoRun.inf 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_cookis.exe cookis.exe File opened for modification C:\Windows\SysWOW64\_cookis.exe cookis.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2056 set thread context of 4400 2056 cookis.exe 88 PID 2056 set thread context of 4068 2056 cookis.exe 90 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2576 4400 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cookis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F909E9EC-571D-11EF-B1C5-CA89CBF88D4A} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3450489625" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3446583324" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3446583324" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31124266" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31124266" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31124266" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430062146" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4068 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4068 IEXPLORE.EXE 4068 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4400 calc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2056 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 87 PID 1724 wrote to memory of 2056 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 87 PID 1724 wrote to memory of 2056 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 87 PID 2056 wrote to memory of 4400 2056 cookis.exe 88 PID 2056 wrote to memory of 4400 2056 cookis.exe 88 PID 2056 wrote to memory of 4400 2056 cookis.exe 88 PID 2056 wrote to memory of 4400 2056 cookis.exe 88 PID 2056 wrote to memory of 4400 2056 cookis.exe 88 PID 2056 wrote to memory of 4068 2056 cookis.exe 90 PID 2056 wrote to memory of 4068 2056 cookis.exe 90 PID 2056 wrote to memory of 4068 2056 cookis.exe 90 PID 1724 wrote to memory of 1648 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 91 PID 1724 wrote to memory of 1648 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 91 PID 1724 wrote to memory of 1648 1724 86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe 91 PID 4068 wrote to memory of 3024 4068 IEXPLORE.EXE 94 PID 4068 wrote to memory of 3024 4068 IEXPLORE.EXE 94 PID 4068 wrote to memory of 3024 4068 IEXPLORE.EXE 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\86441f2bdcebaff18508df7e7abeb8fe_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\cookis.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵
- Suspicious use of UnmapMainImage
PID:4400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 124⤵
- Program crash
PID:2576
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4068 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""2⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 44001⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD56fbf342fb1f5d9024b01619736f59270
SHA1e935c410f225fa10e80976634eec5093d40b1ea8
SHA2564728f57c64042d20d7261e212f7538c543511b7dd0419eb8680531b5179f5ba2
SHA5128d201d8997bea21e95e036fd86d566899902b3c981d75d81ea1c00e3cddf638b4ea8b6ca76a9058e9da35815161bdb796454bf66ff6c8b774d236a1bb7e93f38
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
333KB
MD586441f2bdcebaff18508df7e7abeb8fe
SHA183bf95c9d04b2b138324487b7e84f74ba38047e8
SHA256106551fca79f7aef8d903cb967cf58bcc312fb27fbadd77ec08c77dcf9effea9
SHA51254f6ddca3780a82c234fa36a307a1fb7c01411bf1e14906dd192d29a20f77c88adbb9a06150ff4ac88c26ed8058b3cd6486ed0bb7ea0294eba9b1569e41cc3b5