Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 08:56

General

  • Target

    fa1a73c0041f9a6dc334a899567ad771_JaffaCakes118.exe

  • Size

    375KB

  • MD5

    fa1a73c0041f9a6dc334a899567ad771

  • SHA1

    4aab66d23775b7688370311f60ea246cccedd6d4

  • SHA256

    28134c580c384d5d2af223a07d0ff14ab2d507266ac88735935f90cdbe20ee89

  • SHA512

    1b50ea705a9a3fa4235e2175572ac98844c91ec5e4b861925af12b457aee3b9f4296af49f00eeffe14e470a59b0f4221c26e8316e9d4a5be0cc986905d137a1d

  • SSDEEP

    6144:+XSlgD5NZW+Sj9nJ7VzA2zhS7EBFoQ1IvtxXszhTgJrtrAFXz1XGRpv5AaziUh7z:+sgD5Ns+SZnJxe7E12DXsJg1+BzsuaGq

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa1a73c0041f9a6dc334a899567ad771_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa1a73c0041f9a6dc334a899567ad771_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3b3f758c36c0b2a98cc22be854130cc0

    SHA1

    f6c1bad428cb63ff1becd78b7084c413c5756dfb

    SHA256

    ca1320f2f5452d023ab94d463db72516abaf5ae381faed0e6476730e66a659ba

    SHA512

    74f42a08a76d9adcfb8b1a8b0905182cdc7f1cd6cfdb2f38b2bec24a5fa6d7814350af22d6796a5a492576522f49e487440f80c90831562934dfa937e5941dfa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a01c20a7b1ee67ac345c56832415f60c

    SHA1

    bcff3c51d6255d3146c8ef145ddce043ff3ce8ca

    SHA256

    11c2a48e3cac0efe2b964522de7f7522e1e76c127e0a6495ce427e31f482410c

    SHA512

    b178bb793ca2199cd6bb6fdbd0ae32f5561437caa40acbf4cd21a6de2521398c6bbf37a83ba9bf513901f79fd4b214254242e7d6f896a22a7149c96225e68d84

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6766fa14263a90a7609dc62c4a00c2b8

    SHA1

    cd5590d5e6730fba07488aea9569c5b95421ab71

    SHA256

    18ca900ece12107622fff7b3824aaefa212f50fd0e5ecd957600ed8f34275751

    SHA512

    e8d608828cd8077039b2cb4f4877c896c0ed15304d59100d1288aa0e5e5812dbebe0787b4a6e1913bee91383d445af28f08ecacbf22f9b2566a9869560e47b9c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e830820fa3a43bbf524651cc3788d84a

    SHA1

    982fbb19a5c03e8a2f955d93feea3beaead259f5

    SHA256

    ec8d9320bb5979a77141a092bd29d2a8a2124884c1f12263d4a9592900874213

    SHA512

    49555ddc29ccfb952feb7e7fa6b1ee1da25b13b2c6742d3bb99b7404ca32de3f127001b5c12810551ab2cc5f9ed85be700afcd2aeb3b403c3ccc4ddd642b45ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    43964a22f38c52ffabe7a5ce8484340f

    SHA1

    56143af197befe8803c6e62e146b10a393fd5bd0

    SHA256

    0dbe7e5e55af4e5f4cf2307d30e301d9209122cce1f2ce11305577e384480575

    SHA512

    9d4f0cde28372caed74b91aa44215d324ad4fbbe85fc98857ff41e1ff58003175d028f9ba84f1b7ec25869af6053c758ad6acec57ee5be7802e3d4aad39bdf53

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f996b73417b70f35c82d63ecb4f3b37c

    SHA1

    7eb07fa60878f9504e1c540a5fa3dc85693549aa

    SHA256

    a997e878be360abbf95a646623e1ef132da7fa36447ab4c3b98de426ac76976a

    SHA512

    d412f78439eb529e3dbba1530b930f3064f5581afca7905626b5f9bc98a8a20fad791a7b4e0a7d210f07b332201e7dae40b0e94de67cd81d202775a9c0581895

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3fb45260a819137a459d5a5a680e04e4

    SHA1

    c959a4e575722148c18bd297ae5690f4c43b4824

    SHA256

    60fd53543b4c6763173f66a3a8ce57fa603572934d8d574f12d5dfda8a216092

    SHA512

    5d8a72529ab8827a6dce3bb2593f54aa4112227f0affac3d065d6cf887fa4cc3fd605257b51df2e5459c09cb8d36b8bc439cca0eb96a1e990952f8a002c1f389

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0e9a8eab381e3328e4c8e8f1d5913d04

    SHA1

    318e7ac31962187febb1078d456cf098f85b6ab9

    SHA256

    e27507c75a330081a132b755744f92e5f9979eea614037d4fa86c3fbec0f951d

    SHA512

    65fb6a06269b3eb284234ef2a913388a363523a296da7aceb80c32ce5ce1d52329c8fa3ddc462effdd9c709728c5e2044d2d5da07eba0c4cea751683fd5254b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b7f4a888698b8c90cee0f5ab1884be86

    SHA1

    b02ee247b674e1aae34395b562d4fb8f8631406b

    SHA256

    f4c84aa429ef8358c7318a7edd96bd0a21030e4ebc23eca1016c6fd1119d5464

    SHA512

    60703f386842a0536d0cc720a24b619bd6b79879f70205f6d3988f4cc8116120cf4671ad7c126f5df93ee96ca699f997153f248ebfe6bf679b04b16d500edad3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd582f3f9eacab4e0ee775879e05a70d

    SHA1

    7f57b1bc907f481a169b8360116bda005deb608a

    SHA256

    9c2748fb9efb0c316018cd7fd2edf193f3b375d44c650f43e26a4dfb1bbcb7f9

    SHA512

    29954c25c735de2668dc0c76e9924fe4f2490aeda3e17f83b6c0552e5022454d446d0a463f1df775c02e96df8cdb983b02fe36cbfd367a15f531d9f163277b37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d259810ba88b32e0371db43ab2d7af31

    SHA1

    d445c0161345f71a359efa06f94b32874f7d5e97

    SHA256

    5df88034594c794f3bb5c4bd9c2b512ea08690163da41d0193f173e132e99abb

    SHA512

    f23955d52d60869634eeb4145e8c1edc3c6ceda25d6ad77d4d86de1b9228f8622b0334c1956ee178664201f872d6a81bbb698b13607413432684548561bf0b30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d252b0b396c72538de9eba63f2e3bdaa

    SHA1

    d22c56e08b7e1dc9694c7766a921b5c7c1dafafb

    SHA256

    3f613f2f9b3ece521aa311988372ca647630aff21409545fe965ea60c6208524

    SHA512

    c5ada791ec365812046ffdc3e2c0f37a0f48aaa08d96a55672abb6b871b8a91301acdb71a5b03fd0a3266179b5b14a1186c305c1390b1d996b16a571f492be18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbc5cad05be9011a4af28dfe52d55c47

    SHA1

    118d0e4a192981213da9d4159356e51daab7883f

    SHA256

    a00f59059e4e9cdf95b61f18614e4ff51ee7e9b05f2bf8989c9aa993d42d4e1b

    SHA512

    c5952b76425a162da7cba0f16a37017a147666d2c37b3c900cb465967d68f4a9db505d58183b6e9a476fe041da4ef98f43a0337416ae6790a64368f15f0f1578

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    caf6521d77350c687bbf393a1b09b1d3

    SHA1

    469de8992105ac16e51097347eec507d0b181446

    SHA256

    709c240eca5c1b28562616b492d7da0a311c8b92bb066ff2ed5067e8d60e00b8

    SHA512

    641c09f705a625b048cfa457540d782ffab3d277358891ffd2cf4f92241e8728cef8554da6fce9a98d2f80784718f2a184de4425d0148c6317049377baf9b0be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1f4de26c4c4c9e46a5e342d23859d25

    SHA1

    ed1f6f623ec3709a739e4a539a7d02c036a7640b

    SHA256

    6dc84992f171ebb1a480b9f3b411101e1871d85177db8961c70463f8c8731e1c

    SHA512

    6c1b214c4195f8c0679984f3fd154cd1b4b6af0510192a174619fcb3d12704c3e4c89f10cf41c97a2231619765e92190a0c4b85d45de90f729770bb1403c0d75

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7681755d956be77031265b4091bb09c

    SHA1

    bb7f8d535b1ca70d516fb3cd9de9c9496dd0eafc

    SHA256

    1895c6c3e6dca5ff9c99a0ff255a411659d9bcfb6991d0ca6107cc2340c7c2f3

    SHA512

    009299744497fcdffcf09c32dc5dcc04975a648036e4e18f9c95ac1bd47be9dfc50da65d538e940797f72bbb2c9510829373497d58aa337f8c23eb9cb34c380d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9c36dbe813b3e5266d8c99409abf049

    SHA1

    7fddcf6bcf07f83f969e4cefb21f6aa509034047

    SHA256

    7834807bb03c73ac1be6d7e8afc7b15fd70e4845b6fde5645f9bd2d3ca84b2c7

    SHA512

    748bea2b9567088b0520d475acc1a81a30086c8fff12545c2e617b17c0725c0f6b062c1af8cc0ba7d3d07779c9c7a46a6fa4ddf6ddb14ab9610a40fca31c951f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    82fcf8b577a85ba58e3afa4cc69109ef

    SHA1

    7e676dc7b30e6a9acbfae3844d3deeb92e5cebca

    SHA256

    cdcfff0c14fb0d6ab889c46d7e26da8686c610c297ca6c6b2379f816a9af7ae1

    SHA512

    ec6ca894f2d4901ceb3c18ae6e53ae93c1a17427c8d2f9373b1f3359a8a13c2a23fdfdb0fbeb6e2d6f2382c964c79b3a8b604456249a1f4e873c9deb65bdfffa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ecefd59c1de54d8429c8e40fb9eaea9d

    SHA1

    17a032660bda6a55dd710012ae912e276c0e29d9

    SHA256

    781369d2e963844b32395c696988ebf328e72a5de404fc5f677e831d0e317c07

    SHA512

    481162b787ec6b7307d7a998771c5bf5afd429c1318a1b68ff9307328e002ca1d9fe5919b778766900ca0a1b49df8545dcb928150dca0deeb12c3bc73596e213

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    618c03ff4fdc2be6743736b2d50c73b5

    SHA1

    4a23aa04d8b9bad8442dfeefa7f93437389f9e97

    SHA256

    ea3166773f50fc87dce5a01f7bf9628e0c061f260362357c65b798d007dfb563

    SHA512

    3a6c1145d0761d1754530b15397b4d66b1cd5edfeb99f60ab92f7314b8b74d7232ef04f9a283cfcabb9447e5f93a90c7b1ace1e0e63eaed188fd8df009303956

  • C:\Users\Admin\AppData\Local\Temp\CabCFE0.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD06F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\6.exe

    Filesize

    284KB

    MD5

    93ea993b015ba12c406f72dcb9cbdae9

    SHA1

    7274aee9561a142d48c0d6f1d9d467199f92c4bd

    SHA256

    a1a29bb4d96015042cf705d09cd194c3f64758b73528b75559e6c003c358b8c2

    SHA512

    2d96a6fba1b42af256507435c5860d9d132759c8532e44ead8684f98655c58ccbe343c3a801472eef3ddd12f5e23478ebad9cdceb3c45043a21a9cb388b9522b

  • memory/792-20-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-22-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-25-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-17-0x000000000054C000-0x000000000054D000-memory.dmp

    Filesize

    4KB

  • memory/792-18-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-14-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-27-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/792-21-0x0000000000400000-0x0000000000595000-memory.dmp

    Filesize

    1.6MB

  • memory/2280-26-0x0000000000180000-0x0000000000315000-memory.dmp

    Filesize

    1.6MB

  • memory/2956-2-0x0000000001000000-0x00000000010B9000-memory.dmp

    Filesize

    740KB

  • memory/2956-1-0x000000000105B000-0x000000000105C000-memory.dmp

    Filesize

    4KB

  • memory/2956-23-0x0000000000700000-0x00000000007B9000-memory.dmp

    Filesize

    740KB

  • memory/2956-0-0x0000000001000000-0x00000000010B9000-memory.dmp

    Filesize

    740KB

  • memory/2956-28-0x0000000001000000-0x00000000010B9000-memory.dmp

    Filesize

    740KB

  • memory/2956-11-0x00000000030C0000-0x0000000003255000-memory.dmp

    Filesize

    1.6MB

  • memory/2956-12-0x00000000030C0000-0x0000000003255000-memory.dmp

    Filesize

    1.6MB

  • memory/2956-19-0x0000000001000000-0x00000000010B9000-memory.dmp

    Filesize

    740KB