Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 11:31
Static task
static1
Behavioral task
behavioral1
Sample
e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe
-
Size
166KB
-
MD5
e2616dae4836fc6e4cf181a9f06730de
-
SHA1
65de9fa11e5bdd2f0f1d71d09844b950c8fd010b
-
SHA256
50f5f208658f807fafe8462b0bb538d1aa47ead2b497f870a1aaad5f73241fbf
-
SHA512
1c45930ff90e87d0d4ced0645b8ed3bd6c11df7f14043c5281afb92736261c2f2eac34c80c6b1860b2841d9165c3e16be6027e8dd749171ce815a0aa8bcbfcd5
-
SSDEEP
3072:AQiqldz6bnuKETcDozvr1xWoDImMgP1eNF6Ye+DzQd1Mkv0l3lRKBs:ABbuGgxzILH/6Ybw1fI1Rj
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2744-196-0x0000000010410000-0x000000001046D000-memory.dmp modiloader_stage2 behavioral1/memory/2744-211-0x0000000010410000-0x000000001046D000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2768 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2900 netservice.exe -
resource yara_rule behavioral1/memory/2900-3-0x0000000010410000-0x000000001046D000-memory.dmp upx behavioral1/memory/2744-196-0x0000000010410000-0x000000001046D000-memory.dmp upx behavioral1/memory/2744-211-0x0000000010410000-0x000000001046D000-memory.dmp upx -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\plug\001.dll e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe File created C:\Windows\SysWOW64\netservice.exe e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\netservice.exe e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netservice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2760 e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2900 netservice.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2900 netservice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2760 wrote to memory of 2768 2760 e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe 31 PID 2760 wrote to memory of 2768 2760 e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe 31 PID 2760 wrote to memory of 2768 2760 e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe 31 PID 2760 wrote to memory of 2768 2760 e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe 31 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32 PID 2900 wrote to memory of 2744 2900 netservice.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\e2616dae4836fc6e4cf181a9f06730de_JaffaCakes118.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2768
-
-
C:\Windows\SysWOW64\netservice.exeC:\Windows\SysWOW64\netservice.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\svchost.exe"svchost.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD5e2616dae4836fc6e4cf181a9f06730de
SHA165de9fa11e5bdd2f0f1d71d09844b950c8fd010b
SHA25650f5f208658f807fafe8462b0bb538d1aa47ead2b497f870a1aaad5f73241fbf
SHA5121c45930ff90e87d0d4ced0645b8ed3bd6c11df7f14043c5281afb92736261c2f2eac34c80c6b1860b2841d9165c3e16be6027e8dd749171ce815a0aa8bcbfcd5