Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 07:41

General

  • Target

    dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe

  • Size

    654KB

  • MD5

    dfc171c302a5b87a5d87160b467683cd

  • SHA1

    103f3947b4be2b70c63c96b4905df9230baeb974

  • SHA256

    7f66a1c8db08ce2793d9a21e06ac839b3bde0649fdb69490a988162fc5c2121d

  • SHA512

    57006feb2406dd5d257b53eb9cb79bfb4bd96b949e34a2f4f346bbd969140dc7a69fa6988c8eb49c7f9fb8f41ce817e33f061c3ba91f451c5881dfd331b6c4d7

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJ1T1uxp62KW8CcCzyU56RZv+HFkZhCO0:1tAR2X1Ev8W8CcQy2U1VZhE

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 23 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe"
      2⤵
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\dfc171c302a5b87a5d87160b467683cd_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\mstwain32.exe
          "C:\Windows\mstwain32.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1088
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    654KB

    MD5

    dfc171c302a5b87a5d87160b467683cd

    SHA1

    103f3947b4be2b70c63c96b4905df9230baeb974

    SHA256

    7f66a1c8db08ce2793d9a21e06ac839b3bde0649fdb69490a988162fc5c2121d

    SHA512

    57006feb2406dd5d257b53eb9cb79bfb4bd96b949e34a2f4f346bbd969140dc7a69fa6988c8eb49c7f9fb8f41ce817e33f061c3ba91f451c5881dfd331b6c4d7

  • memory/1088-64-0x00000000003F0000-0x00000000003FE000-memory.dmp

    Filesize

    56KB

  • memory/1088-54-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-79-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-75-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-72-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-69-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-82-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-66-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-58-0x00000000003F0000-0x00000000003FE000-memory.dmp

    Filesize

    56KB

  • memory/1088-52-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-65-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-63-0x00000000001E0000-0x00000000001E8000-memory.dmp

    Filesize

    32KB

  • memory/1088-62-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-85-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-60-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1088-53-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1860-17-0x0000000000400000-0x00000000004E6000-memory.dmp

    Filesize

    920KB

  • memory/1860-0-0x0000000000400000-0x00000000004E6000-memory.dmp

    Filesize

    920KB

  • memory/2240-32-0x0000000000400000-0x00000000004E6000-memory.dmp

    Filesize

    920KB

  • memory/2240-50-0x0000000000400000-0x00000000004E6000-memory.dmp

    Filesize

    920KB

  • memory/2304-18-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-30-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-31-0x0000000003100000-0x00000000031E6000-memory.dmp

    Filesize

    920KB

  • memory/2304-28-0x00000000004B0000-0x00000000004E0000-memory.dmp

    Filesize

    192KB

  • memory/2304-61-0x0000000003100000-0x00000000031E6000-memory.dmp

    Filesize

    920KB

  • memory/2304-24-0x0000000002250000-0x0000000002260000-memory.dmp

    Filesize

    64KB

  • memory/2304-20-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-19-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-11-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-15-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-13-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-9-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-7-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-5-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-3-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2304-1-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB