Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21/08/2024, 10:33
General
-
Target
b31eee5c7a2c40724c550188a7d40f32_JaffaCakes118.exe
-
Size
172KB
-
MD5
b31eee5c7a2c40724c550188a7d40f32
-
SHA1
5ad696609f777f2e03342215166e94929d2d11b6
-
SHA256
8f07be517cb727771d46d59f434a2849c4e45d028fcd101180c426ab8663326d
-
SHA512
45438195dbefb1491e2c15b11a6ab17d9ed35da449a0e2a1b99fa632d00c1fc447eb194975e5845b084b71ed52adce9655e9b5c0001bd000694d9a44793487d6
-
SSDEEP
3072:9nj9PtfUKINndIc0JE54Lqpijx4fhK9XUPqgiDgYveMgJ7OsmWRL9WEvJmtCz1DI:9jneiLWpAuI9XUTikM0OsRRL9gW1a3
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b31eee5c7a2c40724c550188a7d40f32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b31eee5c7a2c40724c550188a7d40f32_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CLEAN2~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CLEAN2~1.EXE2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d787e8f0bcebdaeacab48e6a1d556df9
SHA1cb9cbf926e56728675e6487bdc5143b5eccde8ca
SHA256a7debfd04bffb8ede8b9a9ee6a9594cb22cebe4560e8405dd4d8ddbc99d79faa
SHA5127f30d7c7faf9706b620cd2352a639ac880617841397aedbfd79589d51a355931c7707534d138ce049f9d6c140cbb631bb9be345c69eccf275db0a51521f3ae26
-
Filesize
33KB
MD5932b50a1cfd164966fee4105b2482d89
SHA1bebff6b26e61dd0b1565607ccba89c9d94d79c52
SHA25695c77c8bdb45061988e41ce3bab81490275231ade4189df1dce9596f6275a642
SHA512440b1b87cddb50eb22a19d5841253a7caf80a0af2966dc8b3826e6345c787a68d004bb84abfd9ff8fb87a41f17851d75e77c7180f4ab45c5c4357241e5e69157
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
32KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
56KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
56KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB