Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 04:41

General

  • Target

    e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe

  • Size

    595KB

  • MD5

    e1b8cb2c2182c309f596e3b679f404b4

  • SHA1

    0dc00d6e8651a62a401a84f447cdce226500cb37

  • SHA256

    89a7c3541ad39e4bfa5a665869e0934cd4cc6cc9bead30dfa2ee3a7b3c93ae81

  • SHA512

    73bbdbab008eb2c2bbdbf197fde961f873d0e28f5ea48a4e56dddd6cd96a437d1394757b5007436c97af95518651df953b11d09166d6f46c0660773fa13b593e

  • SSDEEP

    12288:iEKnwM8X1eZ6oV9iqm6FWs72MEvmFsKF3Z4mxx1oo38pN0trn3:iXboepDzfkovQmXJCsr3

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\calc.exe
        "C:\Windows\system32\calc.exe"
        3⤵
          PID:2556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 300
          3⤵
          • Loads dropped DLL
          • Program crash
          PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
        2⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2840

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.bat

      Filesize

      212B

      MD5

      2c329d3caed08f82a6cf85751cf7dbde

      SHA1

      fdf7cdf5376f0b68e403ecacf59dc56900730591

      SHA256

      46bef1c43658515a5b994072d21855760cd46107e103685aca559f6921818c60

      SHA512

      93cde3b542c9239b75fc685b3560f56b750252f15f124dbd1def480f05649f89d2f5984f92aa7fcc998cbde0d2e4206e4376f106bdbbb9c880ff4ea3ebd5eda0

    • \Program Files\Common Files\Microsoft Shared\MSInfo\rejoice91.exe

      Filesize

      595KB

      MD5

      e1b8cb2c2182c309f596e3b679f404b4

      SHA1

      0dc00d6e8651a62a401a84f447cdce226500cb37

      SHA256

      89a7c3541ad39e4bfa5a665869e0934cd4cc6cc9bead30dfa2ee3a7b3c93ae81

      SHA512

      73bbdbab008eb2c2bbdbf197fde961f873d0e28f5ea48a4e56dddd6cd96a437d1394757b5007436c97af95518651df953b11d09166d6f46c0660773fa13b593e

    • memory/1448-26-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-65-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-4-0x00000000020A0000-0x00000000020A1000-memory.dmp

      Filesize

      4KB

    • memory/1448-5-0x0000000002030000-0x0000000002031000-memory.dmp

      Filesize

      4KB

    • memory/1448-6-0x0000000002020000-0x0000000002021000-memory.dmp

      Filesize

      4KB

    • memory/1448-7-0x0000000002090000-0x0000000002091000-memory.dmp

      Filesize

      4KB

    • memory/1448-8-0x0000000002080000-0x0000000002081000-memory.dmp

      Filesize

      4KB

    • memory/1448-9-0x00000000020B0000-0x00000000020B1000-memory.dmp

      Filesize

      4KB

    • memory/1448-10-0x0000000002040000-0x0000000002041000-memory.dmp

      Filesize

      4KB

    • memory/1448-11-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-12-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-13-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-14-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-15-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-16-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-17-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-18-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-19-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-20-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-21-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-22-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-23-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-24-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-25-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-3-0x0000000002050000-0x0000000002051000-memory.dmp

      Filesize

      4KB

    • memory/1448-0-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-44-0x00000000043D0000-0x000000000452B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-29-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-30-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-31-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-32-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-33-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-34-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-2-0x0000000002070000-0x0000000002071000-memory.dmp

      Filesize

      4KB

    • memory/1448-80-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-28-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-43-0x00000000043D0000-0x000000000452B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-1-0x0000000000660000-0x00000000006B4000-memory.dmp

      Filesize

      336KB

    • memory/1448-61-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-62-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-59-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/1448-60-0x0000000000660000-0x00000000006B4000-memory.dmp

      Filesize

      336KB

    • memory/1448-64-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/1448-66-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-27-0x00000000033C0000-0x00000000033C1000-memory.dmp

      Filesize

      4KB

    • memory/1448-63-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/2556-54-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/2556-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2584-68-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/2584-47-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB

    • memory/2584-46-0x0000000000400000-0x000000000055B000-memory.dmp

      Filesize

      1.4MB