Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2024, 17:36

General

  • Target

    f8e1e0ca8455875c0b1859d8b72b4abe_JaffaCakes118.exe

  • Size

    18KB

  • MD5

    f8e1e0ca8455875c0b1859d8b72b4abe

  • SHA1

    e09b58c26581c93494112df39f62c61f24484d6d

  • SHA256

    7349c59e9d940172b45e0c1a29111153629afd2701536dfacd4e1c5de8021279

  • SHA512

    043620a70a2c70fc5e66a949243ae439e2a5622c4d129a4c70d3c26231c9afbe9dcdd6ebd61beef066cfb8fecefad87b6f88a71b0335fafbe768f8e6c6b094b3

  • SSDEEP

    384:Xjgaflarq6qC0rDHpPDx9POJikaW1DOjJUycMO+JTYD3yX:Xlfn6qZ3H1DPPOJDLijJUycRskDC

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8e1e0ca8455875c0b1859d8b72b4abe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f8e1e0ca8455875c0b1859d8b72b4abe_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c copyself.bat
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\copyself.bat

    Filesize

    88B

    MD5

    6e66f44856c288c2edd28a66f32f40c4

    SHA1

    71d1ee4a32a28aea4f131da32238c858cf60f2ba

    SHA256

    848141cd3967d5605e8af69a67db660c3f0202d4635ede1dceb5383055e395d2

    SHA512

    17970e015f795a632511e599a959b4084b5159cbd5eb1cf132f5fa0b59683915edb7fc7dee85f175501773e7694c9e4f2c0375a2fe7cddd22a5ec413e7289109

  • memory/2196-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2196-11-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB