Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe
-
Size
604KB
-
MD5
e028124ffacef0fe32918b26009bb9fe
-
SHA1
72b628927d5dd67c9eaa9e2e7addc330e61ca080
-
SHA256
e9d9f9529a1407342d270d3a6501db639597a1406b7720cbec90e44a62e818f6
-
SHA512
0ad2e0a60a0364af89468549637273ee469cf8013c2d4e60fda8c10ce36c910a9d6d0674fd5f8898218ae663f3783a402707ed9373d8d6cf2050f2fdffc4f1fb
-
SSDEEP
12288:x3fnHpXwLT/99MSZXj9uLZucCgaGTWqF3Z4mxxw26We0j9LIkCCXi:xvHpA//oSF9OucAG1QmXpJLIk/
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/2932-34-0x0000000000400000-0x0000000000563000-memory.dmp modiloader_stage2 behavioral1/memory/2804-55-0x0000000000400000-0x0000000000563000-memory.dmp modiloader_stage2 behavioral1/memory/2932-67-0x0000000000400000-0x0000000000563000-memory.dmp modiloader_stage2 behavioral1/memory/2804-78-0x0000000000400000-0x0000000000563000-memory.dmp modiloader_stage2 behavioral1/memory/2932-91-0x0000000000400000-0x0000000000563000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 1268 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2804 rejoice101.exe -
Loads dropped DLL 5 IoCs
pid Process 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\V: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\Z: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\O: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\T: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\Y: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\J: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\N: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\Q: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\R: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\S: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\K: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\L: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\M: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\A: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\E: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\G: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\H: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\I: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\P: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\U: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\W: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened (read-only) \??\X: e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\AutoRun.inf e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened for modification F:\AutoRun.inf e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File created C:\AutoRun.inf e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened for modification C:\AutoRun.inf e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe File opened for modification C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2804 set thread context of 2136 2804 rejoice101.exe 32 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2156 2804 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rejoice101.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2804 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2804 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2804 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 31 PID 2932 wrote to memory of 2804 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 31 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2136 2804 rejoice101.exe 32 PID 2804 wrote to memory of 2156 2804 rejoice101.exe 33 PID 2804 wrote to memory of 2156 2804 rejoice101.exe 33 PID 2804 wrote to memory of 2156 2804 rejoice101.exe 33 PID 2804 wrote to memory of 2156 2804 rejoice101.exe 33 PID 2932 wrote to memory of 1268 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 34 PID 2932 wrote to memory of 1268 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 34 PID 2932 wrote to memory of 1268 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 34 PID 2932 wrote to memory of 1268 2932 e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e028124ffacef0fe32918b26009bb9fe_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 3003⤵
- Loads dropped DLL
- Program crash
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD532841844b4cfaaa26000fdcea95e4d67
SHA1ed79b57354538f48d2be4b735dddd34aa3275843
SHA256986b34f1a00ff9bd14b6e33861976e78e86de952d85d5d98471a181366cb1515
SHA5123f6ae83ca73ca621a64ea3318c51611697382f5fa38a1ec18d64a1ee074b9a37b9023d24f74b4c555b2b221fd1e21eb064da9cc1b5b082654eefc5a684932081
-
Filesize
604KB
MD5e028124ffacef0fe32918b26009bb9fe
SHA172b628927d5dd67c9eaa9e2e7addc330e61ca080
SHA256e9d9f9529a1407342d270d3a6501db639597a1406b7720cbec90e44a62e818f6
SHA5120ad2e0a60a0364af89468549637273ee469cf8013c2d4e60fda8c10ce36c910a9d6d0674fd5f8898218ae663f3783a402707ed9373d8d6cf2050f2fdffc4f1fb