Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

c7d34246df...18.exe

windows7-x64

10

c7d34246df...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 23:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c7d34246dfc3720449d92dc9fa5fc890_JaffaCakes118.exe

  • Size

    844KB

  • MD5

    c7d34246dfc3720449d92dc9fa5fc890

  • SHA1

    0a4c26f6f6270fb6cd2273064b1cc85781eea9e6

  • SHA256

    6a190d452d94624de700f2058a40d20fcc341f5223b7ff55dc45468531ff4898

  • SHA512

    afc50280d6f6e47561f5304b879a6332e40e00eb5ba615d6846b26f29491b9012ae916c2a3c4ab1ebfab9847fca6036845ed888cd899edf655c467dac955dfc2

  • SSDEEP

    24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • ModiLoader Second Stage 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\c7d34246dfc3720449d92dc9fa5fc890_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c7d34246dfc3720449d92dc9fa5fc890_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Users\Admin\srRTMxaDv9.exe
        C:\Users\Admin\srRTMxaDv9.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Users\Admin\siekei.exe
          "C:\Users\Admin\siekei.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2904
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3108
      • C:\Users\Admin\amhost.exe
        C:\Users\Admin\amhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Users\Admin\amhost.exe
          amhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4840
      • C:\Users\Admin\bmhost.exe
        C:\Users\Admin\bmhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:2148
        • C:\Users\Admin\cmhost.exe
          C:\Users\Admin\cmhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Users\Admin\AppData\Local\2a57e064\X
            176.53.17.24:80
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4024
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:2504
          • C:\Users\Admin\dmhost.exe
            C:\Users\Admin\dmhost.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4172
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del c7d34246dfc3720449d92dc9fa5fc890_JaffaCakes118.exe
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4532
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:664

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\2a57e064\X
        Filesize

        41KB

        MD5

        be40a2578e862f1cecc9b9194f524201

        SHA1

        0c379f375f9bcfab2e8d86161cec07fe4a7dbc12

        SHA256

        2c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6

        SHA512

        25fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8

        Download Submit

      • C:\Users\Admin\amhost.exe
        Filesize

        80KB

        MD5

        8ccbe4f27f9710f3e7f75e1d1de57e49

        SHA1

        272e95e476477cd4a1715ee0bcf32318e0351718

        SHA256

        3d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d

        SHA512

        334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0

        Download Submit

      • C:\Users\Admin\bmhost.exe
        Filesize

        258KB

        MD5

        2da0070a7c50f3a078b73b4fb7ee7c02

        SHA1

        999b4860a80b908622fadfc8fae27db66b200932

        SHA256

        f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf

        SHA512

        2d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630

        Download Submit

      • C:\Users\Admin\cmhost.exe
        Filesize

        358KB

        MD5

        03102e4338eb16e0c4dfe106830557e3

        SHA1

        4fdb5baf0900e44e95acdeee1c947be3b0518b39

        SHA256

        7dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139

        SHA512

        c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9

        Download Submit

      • C:\Users\Admin\dmhost.exe
        Filesize

        32KB

        MD5

        198f821850ef4b1b1b4b6d682185d3aa

        SHA1

        6aa88c873daa0134bf765458341018d2b49633d3

        SHA256

        387d080cd97f819766eda03c8935143c39160bfc1070159dea53909d281a91a2

        SHA512

        5b59990c574abd716d740687ff73d526607f0ca769c0a4de853b938944e8d1b6acb2d456b23aae086fbf541772b63938fac07cc36e594145986c28617b3e93e5

        Download Submit

      • C:\Users\Admin\siekei.exe
        Filesize

        344KB

        MD5

        f2e86f5559c3069b16ef3ae14b327bd9

        SHA1

        6c25b429281c5ea6b3763b62af287b8e511254f9

        SHA256

        ab7cc8d77004f9be0a58f3fd70d6215af5d3997caf0e9d584df7ead700e663af

        SHA512

        bc1759a25bb9dc886ae1485a7b298b3a61ee111974763d69b0d25a2b04e49ce3b2ac433cf0ae74cdd498f04202afd2714af14892e5e8997cded9117af4943ee8

        Download Submit

      • C:\Users\Admin\srRTMxaDv9.exe
        Filesize

        344KB

        MD5

        57a5743f47b3a874773041195600909c

        SHA1

        74f5c16a6ca03baea7c684e40d351f1ec484a70d

        SHA256

        eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90

        SHA512

        66c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954

        Download Submit

      • memory/748-81-0x0000000000400000-0x0000000000465C48-memory.dmp

        Filesize

        407KB

        Download

      • memory/748-73-0x0000000000400000-0x0000000000465C48-memory.dmp

        Filesize

        407KB

        Download

      • memory/1636-58-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

        Download

      • memory/4608-49-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/4840-51-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4840-52-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4840-53-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4840-45-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4840-46-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download