Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 19:37

General

  • Target

    dec54a604826272a144fb50eeae276bc_JaffaCakes118.exe

  • Size

    442KB

  • MD5

    dec54a604826272a144fb50eeae276bc

  • SHA1

    1f79da12b4d457ed0249be3b324f4a4ba6c0160c

  • SHA256

    6396b6899aa5aebfdfd081645cd48d0d158d444ebd15bce4696687bc34cfc6a1

  • SHA512

    1278d3c3655b4c53641d940ef82a5e55f78da80dfb28f07cffa02fd263149097c54fd8889dc7b65bc7557a79c59eaa5732b85c79c186d2dcded93c23f874c219

  • SSDEEP

    12288:uIZIJ8lG4lQ+AjrgHNasJ4iopDYU+lQ8FNrnslpRzBqcP:FZIJ8lG4WNg0iops/frEntP

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dec54a604826272a144fb50eeae276bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dec54a604826272a144fb50eeae276bc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\2009_server.exe
      "C:\Users\Admin\AppData\Local\Temp\2009_server.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4fc26fec2f2b253aae3d7b672a539c26

    SHA1

    2f446e99f9f21f86ba17f6866899a68d7969e93f

    SHA256

    f60d0f85c21fa6e7474de27061f4e050de3548813a89f5186ebd4944161fa0c4

    SHA512

    7ab0ac860e3fdbc521405f311673abaf91f7b71f8c6c4fa2e1c11f90fa47e40e35ccf1483aedf83fca89c697bd2a93457b99f4fed4a684f3145dbd289fd3772b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4d816c7980741d8e63f78b6f05173609

    SHA1

    732acc1faed91390d0c518bdf73be307c539d7f9

    SHA256

    17263192fce3f1b974041114493262e19bffd0f028d3f8082ec88bdf6401849f

    SHA512

    d7b88912a996c1b0aaea52c3f4c2150a582b8b46dab7683231fd534cfaaa14527b55db508bef7b340edc0f3ad3742a52c61138086fd12f9362a6e6f5d81ab0a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    625d96a145e8970272f24eccf029f956

    SHA1

    f1bb373e6c85e7f5b51dfe093b982be019cdf0da

    SHA256

    738e861f7da2186b02e806d32e786cae231019de576fe0a8e6f57bb3e46363cc

    SHA512

    8eb3c92801337f0ece19d7a5b399d89529599a3e3b4a55e58c3299784bf5c7db3af88784acdd194623e8bc5ab431f12908a24213d1f52749b14a016e89ccb25d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3f640ad5b21381d7c88ba66d195ace8

    SHA1

    e1db519a5fa27e6e9e840d834811076ac0a60fc7

    SHA256

    8d8ba0ffd61a4ddfe70f6034a7eb7c80d17abf1529ec4fd143e1b28a3d41dacd

    SHA512

    61af8f28e0b18e1209210518fe8f73025453cd398cadc1c85591551ad2738c8621d7190763e517c1a487b0bffbecce945439f18816ad686bdf20a4deb1ebc556

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66130e3d23f80b5dbe8028ae123549c9

    SHA1

    46e99d4e7a6ff745f37332fa4a8064bf7117e6f2

    SHA256

    d148b5fb15806ea9e82bd99085c74159421e2f7379e0ae29e32f049220a77cd3

    SHA512

    8e01de360d6d931741d23f7bd2afe48210ea61ce1bc04f94eee9e63fce209907a95a80c65b31f312918c778ca3cce3cc2f73344b7408ac764faa8c51a8d2a585

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f558dcba4c99ef9695951ed5d0dcafb4

    SHA1

    120bbcc40715ccc43d4fe9e2885be11c1d74029b

    SHA256

    2687d97781afa4d221cde607b1542e58d38e127b69907b5f60585afa126b612b

    SHA512

    6b484b567a417c218a953a2c1ba1c42c9e33119d86cebad40af584e0d0354a28ec13e83407d0e06f683f52e38eb5988b751e0831e9537a173e4c7eed5a892d8e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b3be7b09111268fcfccb795396fb621a

    SHA1

    c00aea2fe876567b47bf09ea385d33179fb53561

    SHA256

    5d9a2b0b1a8c5cb8f5684a48ad7c4a92e0ec16fd66a70260f681cdfd1b9b8e4c

    SHA512

    f1a232ddc5c8809d7cc3ba64980fca43a7cb01424c4083bdd26f4391d6fa2199f622912002c7da74f0fe45c9933f69862ffa5627fea074cc8cb542f8165f9461

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    305719bdfd2c0f94371b1d2e75ae6987

    SHA1

    d4970f8eff7e950a18fc54c3e68befedecec4025

    SHA256

    0431a94fb21edbac5d83e54a7def947ffc4e148acaced2c039395932464b8226

    SHA512

    51efefc8221771cd68c5e8694aaaae342338bee682632b4de74c78ff24bd84d71defac1c4f4a6198d0f33ca094c09df43cdb9b8489cef01781051dd79003a85f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    255d41f7f69abf45080e28730d617b75

    SHA1

    c4d80548ef8559304773f971f85aa8cf8966c349

    SHA256

    6e163a5fd743bc9ad2efeb6b4f97a2b4e1f68f893536260fd1397657031d3db6

    SHA512

    7fd916068705cb46952983b66c54672481a0c2a97267f151895d26abad9b4eaf6f90c7fa86eaff0c510d262e0678942dfd77c627f60332008352e0c086949cd1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5129f487209688a2d0fac2f1c3a9014c

    SHA1

    f9f0c0d5d32f331a57fd2d17a0bc115352a27a9f

    SHA256

    18c07d35af0a93d5ab953cd9e57dc2aa23974fce4d11036cbc60521212d61d93

    SHA512

    f6d3bfe66c47576e68470d56cba272a2c6195e39a91a65b030b6b1eab8291d4c900321790d71d36bff8ca2fe7004bd6638360bdf3c40fc440d3570593bab85d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dc71e29beff505e72f0a01c21cee961b

    SHA1

    2d49290ad4191bbd05e2cee0851ad57f5bb1ab3e

    SHA256

    d7ce1544ed3afd3f4e9ffd4a365142a05072855a6f8db8f34f963a1bbf01d76f

    SHA512

    5c4bcc42c2f4f1815c35366b8a00d49b27f11a41fe699e95600be8acba08e1deb53806f9bce5dcb3938d9511837553c8aa7bb60c3eb5f0c4dedda6b5062f3a57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c57212e589328ae86251d09111f14927

    SHA1

    98b8162667180ebf0545e7f8c9a887c25b479759

    SHA256

    7703a0f2b374ed9493db7c31b4aa086585cede3a6c7ae079ba9400243ed25d4c

    SHA512

    a387087343324758e2f4446b0d69b6a363483c628cf1ba3637512d74db9be82ecdcbae02b5746bcc03dbd1d01485cfcea9721d648400a208c0ff7eba31901592

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    900a5bd7c447c7dad23de04803d42a67

    SHA1

    4d6b4611b61ce6d3ef161ae145ccfe6c1594939b

    SHA256

    51e05c2255718d5c065465c2d5cf1d12cf74a35bd558f03ff315bbfa2dcf6cf4

    SHA512

    ab98e7b95dc89814348fc6ea9173b079f98fb23772c25279271036ce68034e841958008102a1f00118b3f3447a76611d2ad60bda9f15896266078286e80a6c7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ae3620a877894771abc78e38136ace54

    SHA1

    e1925f4390462c6f59c047524ed0d24a97aa4387

    SHA256

    eba1194a7cd2063f6c1886ca961113f8160874a311e11334fb7ea324a088fdea

    SHA512

    d8fba442d1ade1e00420fff016e9e1d1d20781705ebf9ed5b314d3b288d9ca4fdfcdf6be0429c97b8a3f2e8423cc31a8c58d91c53f922b5c08f3d3d0f5647855

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    914617569e632c7db6b4953ec50ad80c

    SHA1

    388b378e6d83c9d4a7a5e49b23aff278755bce7a

    SHA256

    963f8898d4f2fba39fb72fae15edfa78b315568393f59e01a0d60cece946261f

    SHA512

    ec3d920c36894d73d16ddae1a253b0404497a883ce4feedf4fd54d5bbc795232f76cd5c9cf76439fb5695ca4755577dde8b3fde4c0bb4ba07edf8e57ceaa24a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b363e808aa0a916b1a43bf6c752b1ad2

    SHA1

    ef3e93329724f842efc7d92bed56627ee4530e65

    SHA256

    971aeaad58c87777be95376a18c4b39f5651ba05699cc3a4fe20abae9b06c868

    SHA512

    f8169a0badd8ae1c556fbdf4d2fe358f3c811b2514a18b678b1b8e8a3d47427a1e28abc3f5a818ed33fcb2be4632c84b4e90fe5b8828be6f24024b8c3df2b358

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86d1d4180a5ede852f6d6663dcd4f081

    SHA1

    ca3fffb816fe6622ac2b6c05d296be890fdb88c2

    SHA256

    6536a4acdfad762058736cbc430af123a9b0c82226a33b83894d5e3b7de4c809

    SHA512

    31f10decbe5014e8f058d795a8681783529e8143e2238505d2b0658f3269029639bcfc3d4c6921873e939ae79c88c42322d0c3217e9ec4d4d5a499779df69311

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b6ad18dd2fc6431300577726d85d9282

    SHA1

    20a39f3dcc38454e36f5a62455ffce8f12c07ec7

    SHA256

    4e0152b03f8a984e62d991273802ec749cbb2af7055453fa5c3aa17fd4e24e5c

    SHA512

    bbc475c9413ed8c1301cf77d133f796c4c007b1c5e2f6194405a4398f2cdefe213ad6c8c9e78395948210e560b6338bb8b4c3502a8d6de09f37b89015df80b7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    268f21d21b3ff8b14ae68c5ca1c1d428

    SHA1

    f9cdbe3b8d4db754ed89fbd55940c65842b12ca6

    SHA256

    a1afb875ac64ed4f3b7c99c716a21f9e73a8c992690ce3f15b078ba2f6df5988

    SHA512

    2d58c38a19f28b807b9eef314a53bc8930167cf4642fc785441882717d46b54b2523582e87ef489a510c8320bf3c19d118f4f21fa86df996da884297fa270e81

  • C:\Users\Admin\AppData\Local\Temp\CabBB54.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBC05.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\2009_server.exe

    Filesize

    708KB

    MD5

    111f0b0604a3cfb90b817433062de9cd

    SHA1

    446e547b125af1038ea8cdf1758f06b68f42d125

    SHA256

    c82c7e7123a83e7f00f9d1d3526fb92dce7c7f2863bd5c8a0ce68d11162d227e

    SHA512

    e1f84462cbd771e6ef4417cf2d60ca07b6ffce4792d2f78968ba071430d088e9fa81af23caf395b22be968aa6eb57acd194d5ed67f766ba006af392ab6d6563b

  • memory/1740-13-0x00000000001B0000-0x000000000026B000-memory.dmp

    Filesize

    748KB

  • memory/2124-10-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2124-14-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/2360-0-0x0000000000220000-0x00000000002CC000-memory.dmp

    Filesize

    688KB