Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 20:58
Behavioral task
behavioral1
Sample
ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
-
Size
732KB
-
MD5
ff538cc6046ad482c5c0000f595b47aa
-
SHA1
cb3a18662982aea123f6e69a30c617ebe0f91c11
-
SHA256
5d8d6fad5f36631d2607cdc622523b84b08de4cf4609724d7ae0e380a9118cf1
-
SHA512
591caf673126e0a7f3aa927f04fa865283cdeceb45ec821529148e88490bf12973f5e1e62daaf214ef7de6388ce983e1b3481d1b5251c2b723238976e4fbc348
-
SSDEEP
12288:5p3orwEBIjeDMBxrFlgv3gsgwuRF4crchjVlSVXeZXhWThK:5pY8YMBxrFlgvg2qT4p84RWTs
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/files/0x0001000000000027-9.dat modiloader_stage2 behavioral1/memory/2908-36-0x0000000000400000-0x00000000004BD000-memory.dmp modiloader_stage2 behavioral1/memory/2924-26-0x0000000000400000-0x00000000004BD000-memory.dmp modiloader_stage2 behavioral1/memory/2616-29-0x0000000000400000-0x00000000004BD000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2856 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2616 rejoice101.exe -
Loads dropped DLL 2 IoCs
pid Process 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\X: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\Y: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\Z: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\H: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\P: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\S: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\Q: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\R: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\U: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\A: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\E: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\G: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\N: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\W: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\I: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\K: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\M: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\O: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\T: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\B: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\J: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened (read-only) \??\L: ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AutoRun.inf ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File created F:\AutoRun.inf ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened for modification F:\AutoRun.inf ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File created C:\AutoRun.inf ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe File opened for modification C:\Windows\SysWOW64\_rejoice101.exe rejoice101.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2616 set thread context of 2924 2616 rejoice101.exe 31 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rejoice101.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2616 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2616 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2616 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2616 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 30 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 2924 2616 rejoice101.exe 31 PID 2616 wrote to memory of 1988 2616 rejoice101.exe 32 PID 2616 wrote to memory of 1988 2616 rejoice101.exe 32 PID 2616 wrote to memory of 1988 2616 rejoice101.exe 32 PID 2616 wrote to memory of 1988 2616 rejoice101.exe 32 PID 2908 wrote to memory of 2856 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 33 PID 2908 wrote to memory of 2856 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 33 PID 2908 wrote to memory of 2856 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 33 PID 2908 wrote to memory of 2856 2908 ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2924
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD508a9840386ac86ceef39f7e6ac4f18d8
SHA1d398db5257e228eca6ed163f516bfb0aa54e7b74
SHA256a782f3fe23959cf399f6214d75c6ebf087f973c4c56edee2d6cded5e72088052
SHA512050ffefaf9f9d54a5a682729bb43e59b4f587a3643cce75200f889e164ca9800e55d8964d221153f8a7fc2c341a111fa8550485bb6d381263eff5cc5ddc5c40c
-
Filesize
732KB
MD5ff538cc6046ad482c5c0000f595b47aa
SHA1cb3a18662982aea123f6e69a30c617ebe0f91c11
SHA2565d8d6fad5f36631d2607cdc622523b84b08de4cf4609724d7ae0e380a9118cf1
SHA512591caf673126e0a7f3aa927f04fa865283cdeceb45ec821529148e88490bf12973f5e1e62daaf214ef7de6388ce983e1b3481d1b5251c2b723238976e4fbc348