Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe
-
Size
26KB
-
MD5
dfdffea906164dbcb0f9aa026bd1a8bf
-
SHA1
f938c13cddf11be730ccd1edc683df656a2ecb31
-
SHA256
f8306eea5eaf985cf09e8619abb9485d1b11cdc9be448c2f9eedb000e4dc2732
-
SHA512
63f21316bf370a9348b54028a3f5c795ac810fc65b620f450f52879bf56541b5781f9671a2402d9ce286b3f1ebf131a354b1635793c114bc2935b587f0d8eaca
-
SSDEEP
768:TfJpFHSLyupC2/kzhTEuWkBpx4CGLbVou:TfJpFHSOuopdTE8xCpF
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2700-13-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral1/memory/2348-12-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2348 wmsj.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\wmsj.exe dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe File opened for modification C:\Windows\wmsj.exe dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe File created C:\Windows\video.dll wmsj.exe File created C:\Windows\wmsj.exe wmsj.exe File created C:\Windows\video.dll dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmsj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2348 2700 dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2348 2700 dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2348 2700 dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2348 2700 dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfdffea906164dbcb0f9aa026bd1a8bf_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\wmsj.exeC:\Windows\wmsj.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5e6b596d7b8fbe9058dea9ec3ddae1d94
SHA1d56d0f7f41e1f992ed613f8463ac5b7bcd8391bd
SHA2565a8dbea7cfe5eeea17632ecee56e0856fc82ddc8a2f202e6555c0d655e400d7e
SHA51264c2a9558d11f5fa2167163a6669480ae037d6ada8b6008d2be1672e07402c386e0cae8a3bd3b3a2474548033d0e5fc65a8369257fac24fb7cae88098833b262
-
Filesize
26KB
MD5dfdffea906164dbcb0f9aa026bd1a8bf
SHA1f938c13cddf11be730ccd1edc683df656a2ecb31
SHA256f8306eea5eaf985cf09e8619abb9485d1b11cdc9be448c2f9eedb000e4dc2732
SHA51263f21316bf370a9348b54028a3f5c795ac810fc65b620f450f52879bf56541b5781f9671a2402d9ce286b3f1ebf131a354b1635793c114bc2935b587f0d8eaca