Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe
-
Size
407KB
-
MD5
dfeddfa4c07eacb5e2052504bc25546c
-
SHA1
83a2847e488c16542e89f9f7a9561dafd59d9c30
-
SHA256
b98c69cb0f48547575d842be6597490f57f44add6ee447d51564cb545fb467c1
-
SHA512
841a094472556a95aa7c32295277dd966289b46d3ac69b02bcb1c5e40feaa97e05103e45c160666817967884afba6dc25f593a9e0aa1723aa4b87135521f2bc3
-
SSDEEP
3072:IN4jWuJ/K87wDfyJlrxvfQE+9ofBEK9o//nQ+UOwmfQ8unpkACjbGcHleMcZDLtG:IKjFJ/K8/rxH3+XMtwjbiA
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/files/0x000d000000012262-5.dat modiloader_stage2 behavioral1/memory/2476-29-0x0000000010000000-0x000000001000E000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
pid Process 2476 finale.exe 2896 finale.exe 2788 TorrentGrabber.exe -
Loads dropped DLL 8 IoCs
pid Process 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 2476 finale.exe 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 2892 WerFault.exe 2892 WerFault.exe 2892 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\finale.exe dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TorrentGrabber.exe dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2476 set thread context of 2896 2476 finale.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2892 2896 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language finale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language finale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TorrentGrabber.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 2788 TorrentGrabber.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2476 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 29 PID 2052 wrote to memory of 2476 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 29 PID 2052 wrote to memory of 2476 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 29 PID 2052 wrote to memory of 2476 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 29 PID 2052 wrote to memory of 2788 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 30 PID 2052 wrote to memory of 2788 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 30 PID 2052 wrote to memory of 2788 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 30 PID 2052 wrote to memory of 2788 2052 dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe 30 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2476 wrote to memory of 2896 2476 finale.exe 31 PID 2896 wrote to memory of 2892 2896 finale.exe 32 PID 2896 wrote to memory of 2892 2896 finale.exe 32 PID 2896 wrote to memory of 2892 2896 finale.exe 32 PID 2896 wrote to memory of 2892 2896 finale.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfeddfa4c07eacb5e2052504bc25546c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\finale.exe"C:\Windows\system32\finale.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\finale.exeC:\Windows\SysWOW64\finale.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 364⤵
- Loads dropped DLL
- Program crash
PID:2892
-
-
-
-
C:\Windows\SysWOW64\TorrentGrabber.exe"C:\Windows\system32\TorrentGrabber.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
MD587b3b3c56f1b1afec43bed9ab3e1c954
SHA18bc9bacce799fffe062c902aea8d40486d2b504d
SHA256ab3b25984121602eee9c1dac170600b22f047448950ee73ad18528e4d3add91e
SHA512439fd7316e8da8c8099a9a9cebbe8d635a3f1e096d084a6191ed6ce2318145b8ca34737e0e5ed12a3beb8ec0706c1f2e819da774656dc868aa98c33cde53a757
-
Filesize
27KB
MD5a32d1f7a613fec3109fafe752bf34d7e
SHA17cf741fccbf1bc43507948226ad85556d5bbb991
SHA256272201fd6b391d74a714e867d9b63d93eab25eb53df862f5453f46d52e1dc00a
SHA51227c3c97cbf7be871849e8b5f9531bf217769406d04b793e126f10b8af74527ffc53d7abcc7120d8bbf5c0f6a073e66033d944ee61356dd600a770626fcb3a9c4