Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe
-
Size
595KB
-
MD5
e1b8cb2c2182c309f596e3b679f404b4
-
SHA1
0dc00d6e8651a62a401a84f447cdce226500cb37
-
SHA256
89a7c3541ad39e4bfa5a665869e0934cd4cc6cc9bead30dfa2ee3a7b3c93ae81
-
SHA512
73bbdbab008eb2c2bbdbf197fde961f873d0e28f5ea48a4e56dddd6cd96a437d1394757b5007436c97af95518651df953b11d09166d6f46c0660773fa13b593e
-
SSDEEP
12288:iEKnwM8X1eZ6oV9iqm6FWs72MEvmFsKF3Z4mxx1oo38pN0trn3:iXboepDzfkovQmXJCsr3
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/1448-34-0x0000000000400000-0x000000000055B000-memory.dmp modiloader_stage2 behavioral1/memory/2584-47-0x0000000000400000-0x000000000055B000-memory.dmp modiloader_stage2 behavioral1/memory/1448-59-0x0000000000400000-0x000000000055B000-memory.dmp modiloader_stage2 behavioral1/memory/2584-68-0x0000000000400000-0x000000000055B000-memory.dmp modiloader_stage2 behavioral1/memory/1448-80-0x0000000000400000-0x000000000055B000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2840 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2584 rejoice91.exe -
Loads dropped DLL 5 IoCs
pid Process 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 2636 WerFault.exe 2636 WerFault.exe 2636 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe File opened for modification C:\Windows\SysWOW64\_rejoice91.exe rejoice91.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2584 set thread context of 2556 2584 rejoice91.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2636 2584 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rejoice91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2584 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 30 PID 1448 wrote to memory of 2584 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 30 PID 1448 wrote to memory of 2584 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 30 PID 1448 wrote to memory of 2584 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 30 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2556 2584 rejoice91.exe 31 PID 2584 wrote to memory of 2636 2584 rejoice91.exe 32 PID 2584 wrote to memory of 2636 2584 rejoice91.exe 32 PID 2584 wrote to memory of 2636 2584 rejoice91.exe 32 PID 2584 wrote to memory of 2636 2584 rejoice91.exe 32 PID 1448 wrote to memory of 2840 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 33 PID 1448 wrote to memory of 2840 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 33 PID 1448 wrote to memory of 2840 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 33 PID 1448 wrote to memory of 2840 1448 e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1b8cb2c2182c309f596e3b679f404b4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice91.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 3003⤵
- Loads dropped DLL
- Program crash
PID:2636
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD52c329d3caed08f82a6cf85751cf7dbde
SHA1fdf7cdf5376f0b68e403ecacf59dc56900730591
SHA25646bef1c43658515a5b994072d21855760cd46107e103685aca559f6921818c60
SHA51293cde3b542c9239b75fc685b3560f56b750252f15f124dbd1def480f05649f89d2f5984f92aa7fcc998cbde0d2e4206e4376f106bdbbb9c880ff4ea3ebd5eda0
-
Filesize
595KB
MD5e1b8cb2c2182c309f596e3b679f404b4
SHA10dc00d6e8651a62a401a84f447cdce226500cb37
SHA25689a7c3541ad39e4bfa5a665869e0934cd4cc6cc9bead30dfa2ee3a7b3c93ae81
SHA51273bbdbab008eb2c2bbdbf197fde961f873d0e28f5ea48a4e56dddd6cd96a437d1394757b5007436c97af95518651df953b11d09166d6f46c0660773fa13b593e