Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 19:30

General

  • Target

    dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe

  • Size

    692KB

  • MD5

    dec23e985f1b0d9f9cf8ee5630c11c5d

  • SHA1

    6724a21dccc752c3bfcd88e928fe56c341e288cf

  • SHA256

    da71b1111bc6537611b461cf4ead02335d5cc11e06e1905b1294a842890148d0

  • SHA512

    8870762234eee0f1a7472172d6601d64be319657537d91bae851dad7ba708e64aaaa12eea705b91cc05079d6508de8365ccc77d7fbb1217bfe74cd9868ecca55

  • SSDEEP

    12288:bWBLcRhSGxuVOqUeh1d3SQ/QDsTXXE9HHDiajKMLrEXHAlo0rfBvJkgeuLPoy2:bCcRhSXhph1oQoIY9HHeajNLrEm3N+gI

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 10 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\dec23e985f1b0d9f9cf8ee5630c11c5d_JaffaCakes118.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\program files\internet explorer\IEXPLORE.EXE
          "C:\program files\internet explorer\IEXPLORE.EXE"
          4⤵
            PID:2832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2252-14-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/2252-0-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/2252-1-0x00000000004B5000-0x00000000004B8000-memory.dmp

      Filesize

      12KB

    • memory/2252-13-0x0000000000580000-0x0000000000638000-memory.dmp

      Filesize

      736KB

    • memory/2424-25-0x00000000004C0000-0x0000000000578000-memory.dmp

      Filesize

      736KB

    • memory/2424-42-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-15-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-16-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2424-8-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-4-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-2-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-6-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2424-17-0x0000000000400000-0x00000000004BB000-memory.dmp

      Filesize

      748KB

    • memory/2688-43-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-22-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-39-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-35-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-32-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-29-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-26-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-20-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-18-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-44-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-46-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB

    • memory/2688-47-0x0000000000400000-0x00000000004BF000-memory.dmp

      Filesize

      764KB