Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe
-
Size
185KB
-
MD5
de2cc2c1665078c2e9505f0a2023d8d3
-
SHA1
d391d6ac173f63ab0f2769de363e3f2c31aed53d
-
SHA256
9e1765cb1ff7d8d337abc21176419d4fcb3c6e0f887d7a4464f049a0ea76b616
-
SHA512
dc5494fd8259553d839c832c6cc4be238c1d3a0d2d0f8c04dcf19a9f5123a5ce5d5ad8ee3a90c4c6d77d02a57e2b13c20396e6789cc52c1c0a1fc98b04c940e8
-
SSDEEP
3072:kOy1kVJFtm0xshpYsrXUsdKF6aNo9Bf+Zh6eTDZQncuXfA5HRTSgI:kh12jsvYsrdKF62o3GZh6eTWtXfCo
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE -
ModiLoader Second Stage 29 IoCs
resource yara_rule behavioral1/memory/3028-9-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3028-10-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3028-21-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3028-19-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-33-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-32-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-34-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-38-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-41-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-42-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-43-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-44-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-45-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-46-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-49-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-53-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-56-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-65-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-68-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-71-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-77-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-80-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-83-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2132-86-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2216 mstwain32.exe 2132 mstwain32.EXE -
resource yara_rule behavioral1/memory/3028-3-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-5-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-7-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-8-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-9-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-10-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-21-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3028-19-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-33-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-32-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-29-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-34-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-41-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-42-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-43-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-45-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-46-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-49-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-53-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-56-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-65-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-68-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-71-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-77-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-80-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-83-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2132-86-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.EXE" mstwain32.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2528 set thread context of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2216 set thread context of 2132 2216 mstwain32.exe 33 -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cmsetac.dll mstwain32.EXE File created C:\Windows\mstwain32.exe de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE File opened for modification C:\Windows\mstwain32.exe de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE File opened for modification C:\Windows\mstwain32.EXE mstwain32.exe File created C:\Windows\ntdtcstp.dll mstwain32.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3028 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE Token: SeDebugPrivilege 2132 mstwain32.EXE Token: SeDebugPrivilege 2132 mstwain32.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 2216 mstwain32.exe 2132 mstwain32.EXE 2132 mstwain32.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 2528 wrote to memory of 3028 2528 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe 31 PID 3028 wrote to memory of 2216 3028 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE 32 PID 3028 wrote to memory of 2216 3028 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE 32 PID 3028 wrote to memory of 2216 3028 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE 32 PID 3028 wrote to memory of 2216 3028 de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE 32 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 PID 2216 wrote to memory of 2132 2216 mstwain32.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE"C:\Users\Admin\AppData\Local\Temp\de2cc2c1665078c2e9505f0a2023d8d3_JaffaCakes118.EXE"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\mstwain32.EXE"C:\Windows\mstwain32.EXE"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2132
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD5de2cc2c1665078c2e9505f0a2023d8d3
SHA1d391d6ac173f63ab0f2769de363e3f2c31aed53d
SHA2569e1765cb1ff7d8d337abc21176419d4fcb3c6e0f887d7a4464f049a0ea76b616
SHA512dc5494fd8259553d839c832c6cc4be238c1d3a0d2d0f8c04dcf19a9f5123a5ce5d5ad8ee3a90c4c6d77d02a57e2b13c20396e6789cc52c1c0a1fc98b04c940e8