Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/09/2024, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe
-
Size
402KB
-
MD5
f8cead5bfe4919d6d2dd82016a7a05f1
-
SHA1
0b0ab8d4b64a9c403c6408592de8f1d441fd5583
-
SHA256
8d876cb4130fb8af097af24b129fb59f6ec7af83d87bc8fe5896953a2591e377
-
SHA512
5bf05c774315833843d25b2bea2d173adb333c7dc1937d8e3fd5e1819b60f61082784c959f4cb07853d37f8098619a3fd0e19b44f727a05e383ad05f0e4c91f7
-
SSDEEP
12288:rylDVdcMafXEezSoT3s6LvUBP8UgjUwC3:+l5dDxe9HLMBP8njUX
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral1/memory/1952-2-0x0000000000400000-0x0000000000546000-memory.dmp modiloader_stage2 behavioral1/memory/1692-16-0x0000000000400000-0x0000000000546000-memory.dmp modiloader_stage2 behavioral1/memory/1952-30-0x0000000000400000-0x0000000000546000-memory.dmp modiloader_stage2 behavioral1/memory/1692-32-0x0000000000400000-0x0000000000546000-memory.dmp modiloader_stage2 behavioral1/memory/1952-40-0x0000000000400000-0x0000000000546000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2584 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1692 MaskTask.exe -
Loads dropped DLL 5 IoCs
pid Process 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 2248 WerFault.exe 2248 WerFault.exe 2248 WerFault.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_MaskTask.exe MaskTask.exe File opened for modification C:\Windows\SysWOW64\_MaskTask.exe MaskTask.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1692 set thread context of 2508 1692 MaskTask.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\MaskTask.exe f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\MaskTask.exe f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2248 1692 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MaskTask.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1692 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 30 PID 1952 wrote to memory of 1692 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 30 PID 1952 wrote to memory of 1692 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 30 PID 1952 wrote to memory of 1692 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2508 1692 MaskTask.exe 31 PID 1692 wrote to memory of 2248 1692 MaskTask.exe 32 PID 1692 wrote to memory of 2248 1692 MaskTask.exe 32 PID 1692 wrote to memory of 2248 1692 MaskTask.exe 32 PID 1692 wrote to memory of 2248 1692 MaskTask.exe 32 PID 1952 wrote to memory of 2584 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 34 PID 1952 wrote to memory of 2584 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 34 PID 1952 wrote to memory of 2584 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 34 PID 1952 wrote to memory of 2584 1952 f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8cead5bfe4919d6d2dd82016a7a05f1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\MaskTask.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\MaskTask.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2803⤵
- Loads dropped DLL
- Program crash
PID:2248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD56bbcc3d83ff6f62cc5922f4b872d3363
SHA1b0176106487dd5069e6e56059d25fa1f4ebf6ba3
SHA2565754aa33c5f828f87dc5280f27de10195a52e4306233f68d25a693e6d61dafd7
SHA51209bdc8b011fe746ab886904fc26627a34646136fe486911c6e012b2b3d9ff54273495a650f2fc4f977e04fb2ff4dd5fbfe666a85f36aa7d3a0903bff5c682294
-
Filesize
402KB
MD5f8cead5bfe4919d6d2dd82016a7a05f1
SHA10b0ab8d4b64a9c403c6408592de8f1d441fd5583
SHA2568d876cb4130fb8af097af24b129fb59f6ec7af83d87bc8fe5896953a2591e377
SHA5125bf05c774315833843d25b2bea2d173adb333c7dc1937d8e3fd5e1819b60f61082784c959f4cb07853d37f8098619a3fd0e19b44f727a05e383ad05f0e4c91f7