Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe
-
Size
240KB
-
MD5
e0ced5e9d4ed7f8ea0ba5e616df4ab4a
-
SHA1
61933f101244016284f26eb8ed50bbeaef2d0bc8
-
SHA256
b70469d8c92cf656312410cb70856052a1a3a5acf86c6ce56886e0cb0af1689a
-
SHA512
ac34c1aa5ce669e9bcf87e25130d389f7c67bc1211542f8b2caecb68e8960c6cb21bb4aaf37b9425e984737df90ae67fb6e56e833b35785ebeb3639029a349f4
-
SSDEEP
6144:6KzkPr4yfkDAp18uJmp8DO9AHYPvRV/5HBQqjqRY2:6Kmr4yfkDAb8r2Oyaj/vqRY2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 2940 mshta.exe 97 -
ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral2/memory/4876-0-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral2/memory/4876-2-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral2/memory/4876-3-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral2/memory/4876-4-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral2/memory/4876-9-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-8-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-7-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-6-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-5-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-10-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 behavioral2/memory/4876-11-0x0000000000AD0000-0x0000000000BA6000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation mshta.exe -
pid Process 1016 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1048 set thread context of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" mshta.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mshta.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\International\CpMRU mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" mshta.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1016 powershell.exe 1016 powershell.exe 1016 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1016 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 1048 wrote to memory of 4876 1048 e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe 102 PID 4504 wrote to memory of 1016 4504 mshta.exe 104 PID 4504 wrote to memory of 1016 4504 mshta.exe 104 PID 4504 wrote to memory of 1016 4504 mshta.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e0ced5e9d4ed7f8ea0ba5e616df4ab4a_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:81⤵PID:1564
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:qQBxA8XQ="CMdnN";qf5=new%20ActiveXObject("WScript.Shell");zy6e5yl="4UqLPec";vJs97V=qf5.RegRead("HKLM\\software\\Wow6432Node\\6ARFD9X2\\2AcN7vFYi");w0xfIoS="53oY4Xj";eval(vJs97V);P6hVecpn="GG";1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:elyximqu2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82