Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe
-
Size
444KB
-
MD5
fa11ba0c8ceeff9d9f87181c29b85024
-
SHA1
17e272ebb9cb475be6e25f9515e69c7a80c69a70
-
SHA256
794eb66ecb5fc7a631092e8f58205b231efedba0263a0e971b7811716c754928
-
SHA512
f427155d1dd0e09311cbd943c1aea21514a5e72c7afb0b45060b7fa2f8d6024f5f6377cf0efc86b631428c3fbf55a886a814e47eccf11099fd717bb9d2738fb9
-
SSDEEP
12288:MhQ7lM9czEgn+vHbRs7DR90WZPTc4Q2FTD8:flMWn+zRs/A4Tc4bD8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/4888-3-0x0000000000400000-0x00000000004BC011-memory.dmp modiloader_stage2 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2728 4888 fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe 81 PID 4888 wrote to memory of 2728 4888 fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa11ba0c8ceeff9d9f87181c29b85024_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵PID:2728
-