Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe
-
Size
142KB
-
MD5
f7f0423dc124729b232603cfe51520e7
-
SHA1
cb40477760295efc448e6ffa5da999417aa831df
-
SHA256
70cacdaca21d0cd2b647ef37b89ee46689a2e510531e6e2e6974070d332cbc83
-
SHA512
2f529a825673eb4808fcb30e4218cc7ecf46dd0c3cf94278ce78e57b6c09059535aa29da0485cb1a53507c89c37e632dd32691a0dd0d3105204e627f3c052592
-
SSDEEP
3072:3fdFBbMqqDa/E737nr2IAh9J68nbwA9WxRTxI2qN2Gni12BIN7MiU:vdHYqqDGES5Y0WxV+2qLiWSU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 25 IoCs
resource yara_rule behavioral2/memory/4736-5-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4736-6-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4736-15-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-24-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-26-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-33-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-39-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-40-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-41-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-42-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-43-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-46-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-47-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-53-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-56-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-65-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-68-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-71-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-77-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-80-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4648-83-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 4648 mstwain32.exe -
Executes dropped EXE 2 IoCs
pid Process 4420 mstwain32.exe 4648 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 4648 mstwain32.exe 4648 mstwain32.exe 4648 mstwain32.exe 4648 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2684 set thread context of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 4420 set thread context of 4648 4420 mstwain32.exe 87 -
resource yara_rule behavioral2/memory/4736-2-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4736-4-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4736-5-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4736-6-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4736-15-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-24-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-26-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-33-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-39-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-40-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-41-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-42-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-43-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-46-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-47-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-53-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-56-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-65-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-68-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-71-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-77-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-80-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4648-83-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4736 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe Token: SeBackupPrivilege 1048 vssvc.exe Token: SeRestorePrivilege 1048 vssvc.exe Token: SeAuditPrivilege 1048 vssvc.exe Token: SeDebugPrivilege 4648 mstwain32.exe Token: SeDebugPrivilege 4648 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4648 mstwain32.exe 4648 mstwain32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2684 wrote to memory of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 2684 wrote to memory of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 2684 wrote to memory of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 2684 wrote to memory of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 2684 wrote to memory of 4736 2684 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 82 PID 4736 wrote to memory of 4420 4736 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 86 PID 4736 wrote to memory of 4420 4736 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 86 PID 4736 wrote to memory of 4420 4736 f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe 86 PID 4420 wrote to memory of 4648 4420 mstwain32.exe 87 PID 4420 wrote to memory of 4648 4420 mstwain32.exe 87 PID 4420 wrote to memory of 4648 4420 mstwain32.exe 87 PID 4420 wrote to memory of 4648 4420 mstwain32.exe 87 PID 4420 wrote to memory of 4648 4420 mstwain32.exe 87 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\f7f0423dc124729b232603cfe51520e7_JaffaCakes118.exe"4⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4648
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD54a8c31a0bbacf84a058285cff9e731c1
SHA19d804d763be3ea7903930617aa63a007f08a5bf4
SHA25613cf5aa36c0588b2592d1e1627ba54f2b86c504af716c648197dce6fe1bacb82
SHA5122121fdde3dd841fd508cc472930308b28e64288c4163e8a195d6f4203c258dc95f1b4b5cb673580da49513f81078407ea145d6ab17250efa3cf5ccae0ebb41ed
-
Filesize
142KB
MD5f7f0423dc124729b232603cfe51520e7
SHA1cb40477760295efc448e6ffa5da999417aa831df
SHA25670cacdaca21d0cd2b647ef37b89ee46689a2e510531e6e2e6974070d332cbc83
SHA5122f529a825673eb4808fcb30e4218cc7ecf46dd0c3cf94278ce78e57b6c09059535aa29da0485cb1a53507c89c37e632dd32691a0dd0d3105204e627f3c052592
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350