Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 06:11
Static task
static1
Behavioral task
behavioral1
Sample
ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe
-
Size
582KB
-
MD5
ecfe2304b6c1de57791ac6f82c832cd3
-
SHA1
1a8d4278b3a87f08ef66e1d786343910a7e72484
-
SHA256
7773863c1d5e87cb96f710e1e4971127d0cabb7b0a77295a155949954f5da70c
-
SHA512
0fe68096bd1dca3fd85e0b809f07ef46cc5226898ec96cd0e3861726145d7feb02952312f0fa33aafc283ad323022c009659f5aa63313dddc2a4444f0afaad49
-
SSDEEP
12288:XsRAerkwxw4ymqyTuwF3Z4mxx74IxSo62jDrkAL:XsPkoiVyTuwQmX/sohk4
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/memory/2336-40-0x0000000000400000-0x0000000000554000-memory.dmp modiloader_stage2 behavioral1/memory/2132-46-0x0000000000400000-0x0000000000554000-memory.dmp modiloader_stage2 behavioral1/memory/2336-50-0x0000000000400000-0x0000000000554000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2132 rejoic.exe -
Loads dropped DLL 5 IoCs
pid Process 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 2788 WerFault.exe 2788 WerFault.exe 2788 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoic.exe rejoic.exe File opened for modification C:\Windows\SysWOW64\_rejoic.exe rejoic.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2132 set thread context of 2676 2132 rejoic.exe 32 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2788 2132 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rejoic.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2132 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2132 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2132 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 31 PID 2336 wrote to memory of 2132 2336 ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe 31 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2676 2132 rejoic.exe 32 PID 2132 wrote to memory of 2788 2132 rejoic.exe 33 PID 2132 wrote to memory of 2788 2132 rejoic.exe 33 PID 2132 wrote to memory of 2788 2132 rejoic.exe 33 PID 2132 wrote to memory of 2788 2132 rejoic.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecfe2304b6c1de57791ac6f82c832cd3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoic.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 3003⤵
- Loads dropped DLL
- Program crash
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
582KB
MD5ecfe2304b6c1de57791ac6f82c832cd3
SHA11a8d4278b3a87f08ef66e1d786343910a7e72484
SHA2567773863c1d5e87cb96f710e1e4971127d0cabb7b0a77295a155949954f5da70c
SHA5120fe68096bd1dca3fd85e0b809f07ef46cc5226898ec96cd0e3861726145d7feb02952312f0fa33aafc283ad323022c009659f5aa63313dddc2a4444f0afaad49