Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 12:16

General

  • Target

    fa641edc81ec21b0bda7d6e47bd23a10_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    fa641edc81ec21b0bda7d6e47bd23a10

  • SHA1

    1a78415d815d1b974389b4824c2c5b082209a84c

  • SHA256

    2f74e41c8484e679aa1cf3ec97b5aadfcca0ec8d4fa75d325ae735223a7734a5

  • SHA512

    6e52986e834ceb49e70c645552ed2c38438bf385d48793a57983bc892577fef0da3f940090086ae7d8636427f845e75a11f9093c4d16a9f45324c732feb97dae

  • SSDEEP

    24576:ix03nIlcXgYZhukuphb03nZupGxe9qee4fjuS2Vp6RwT6JvHF:ix0ycXgYWFX0cz9/e4f0p6ST6dl

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 16 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa641edc81ec21b0bda7d6e47bd23a10_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa641edc81ec21b0bda7d6e47bd23a10_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Users\Admin\AppData\Local\Temp\Minecraft.exe
      "C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
    • C:\Users\Admin\AppData\Local\Temp\turkojan.exe
      "C:\Users\Admin\AppData\Local\Temp\turkojan.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:3180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Minecraft.exe

    Filesize

    679KB

    MD5

    605a171c61a0607bdcf6be80ed07cf95

    SHA1

    477d4391b0d84406127e43ead289a3596ac1e5e5

    SHA256

    09b78dc85713ca0f27f17d94c939cc606a59847c1f2b5cdd281b52a48cdaeab9

    SHA512

    3b32197d76951d0e1cd7043758af9b33be12b30c03df00a3ef36078205fa95b1582f65bdf4437a1b879a922d2950868e905bcd2227ce3816d5437556b103d338

  • C:\Users\Admin\AppData\Local\Temp\turkojan.exe

    Filesize

    270KB

    MD5

    d653d7589ab105309802257ae34ad2c6

    SHA1

    2a6cec5747d24282b4a1a11f6466d995f1915b0f

    SHA256

    64d9facd7ded7298e3023a06905f7e76efc23b8d7d887c9b7046804b836fa4cc

    SHA512

    a9f49ed02382d2e367a99ba123eee2dea768d9a3923c0ebb3c56e4b170985000cbd1ae9519b8fb5fa34245f5a0410d0464c1e35a3c35762c61b0f2f016d26e54

  • C:\Windows\cmsetac.dll

    Filesize

    33KB

    MD5

    52ba2fae7475c4861c79f6d38f7ef25f

    SHA1

    04896b6834354fb7895c62c48d6d14569db5764e

    SHA256

    12893275587056471ba411d4b6fb3d5d80aa572fcb9cfd1bc1a5fa4053a42135

    SHA512

    c0d5c18c02885aaf3fde0ace5e70117c3378f1f90b64fd54ac7580203660ed303923a46df8d0aa15dd456f61f0972669ce2f8b15f6452c23bc12e40c8082fbd9

  • C:\Windows\ntdtcstp.dll

    Filesize

    7KB

    MD5

    67587e25a971a141628d7f07bd40ffa0

    SHA1

    76fcd014539a3bb247cc0b761225f68bd6055f6b

    SHA256

    e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

    SHA512

    6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

  • memory/1572-40-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-61-0x0000000000980000-0x0000000000988000-memory.dmp

    Filesize

    32KB

  • memory/3180-62-0x00000000030E0000-0x00000000030EE000-memory.dmp

    Filesize

    56KB

  • memory/3180-101-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-98-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-95-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-92-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-89-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-86-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-51-0x00000000030E0000-0x00000000030EE000-memory.dmp

    Filesize

    56KB

  • memory/3180-83-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-80-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-77-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-74-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-71-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-60-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-68-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/3180-65-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/4080-3-0x000000001BE80000-0x000000001C34E000-memory.dmp

    Filesize

    4.8MB

  • memory/4080-32-0x00007FF887310000-0x00007FF887CB1000-memory.dmp

    Filesize

    9.6MB

  • memory/4080-6-0x000000001B9A0000-0x000000001B9A8000-memory.dmp

    Filesize

    32KB

  • memory/4080-0-0x00007FF8875C5000-0x00007FF8875C6000-memory.dmp

    Filesize

    4KB

  • memory/4080-7-0x000000001C600000-0x000000001C64C000-memory.dmp

    Filesize

    304KB

  • memory/4080-1-0x000000001B8F0000-0x000000001B996000-memory.dmp

    Filesize

    664KB

  • memory/4080-2-0x00007FF887310000-0x00007FF887CB1000-memory.dmp

    Filesize

    9.6MB

  • memory/4080-5-0x00007FF887310000-0x00007FF887CB1000-memory.dmp

    Filesize

    9.6MB

  • memory/4080-4-0x000000001C4A0000-0x000000001C53C000-memory.dmp

    Filesize

    624KB

  • memory/4452-64-0x0000000004E90000-0x0000000004E9E000-memory.dmp

    Filesize

    56KB

  • memory/4452-57-0x0000000004E90000-0x0000000004E9E000-memory.dmp

    Filesize

    56KB

  • memory/4452-63-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/4452-58-0x0000000000400000-0x0000000000489000-memory.dmp

    Filesize

    548KB

  • memory/4452-59-0x0000000004E90000-0x0000000004E9E000-memory.dmp

    Filesize

    56KB