Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe
-
Size
205KB
-
MD5
ca529b9a36c74d66f877cf52addefab0
-
SHA1
6e932f4e2f51fa351070cf0e2c426f930da7e19b
-
SHA256
bb7552982ca26ee9cb795930acf815b60593d6705a5160c92de6f186dfef784a
-
SHA512
25921db9d542af8caa62145d43e699c095f324a1020e5fe13943748f093d165240443e2520c5e5352a171697b60f0ca73be603430cee64c8c2db1df8d3dc0239
-
SSDEEP
6144:GXkVBFAveiN7Za1NVGFdi7AEQGjCahwCrKoU:GXCYxZYsdGAHGj/XU
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 23 IoCs
resource yara_rule behavioral1/memory/2720-8-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2720-7-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2720-9-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2720-21-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-32-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-33-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-39-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-40-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-43-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-44-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-47-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-53-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-57-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-60-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-63-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-66-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-69-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-72-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-75-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2756-81-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2004 mstwain32.exe 2756 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1508 set thread context of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 2004 set thread context of 2756 2004 mstwain32.exe 35 -
resource yara_rule behavioral1/memory/2720-5-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-3-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-6-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-8-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-7-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-9-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2720-21-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-32-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-30-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-29-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-33-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-39-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-40-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-43-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-47-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-53-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-60-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-63-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-66-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-69-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-72-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-75-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2756-81-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe mstwain32.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe Token: SeBackupPrivilege 2736 vssvc.exe Token: SeRestorePrivilege 2736 vssvc.exe Token: SeAuditPrivilege 2736 vssvc.exe Token: SeDebugPrivilege 2756 mstwain32.exe Token: SeDebugPrivilege 2756 mstwain32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 2004 mstwain32.exe 2756 mstwain32.exe 2756 mstwain32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 1508 wrote to memory of 2720 1508 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2004 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 34 PID 2720 wrote to memory of 2004 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 34 PID 2720 wrote to memory of 2004 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 34 PID 2720 wrote to memory of 2004 2720 ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe 34 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 PID 2004 wrote to memory of 2756 2004 mstwain32.exe 35 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ca529b9a36c74d66f877cf52addefab0_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2756
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\699c4b9cdebca7aaea5193cae8a50098_5a410d66-f84f-4a6b-9b29-3982febe58d9
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
205KB
MD5ca529b9a36c74d66f877cf52addefab0
SHA16e932f4e2f51fa351070cf0e2c426f930da7e19b
SHA256bb7552982ca26ee9cb795930acf815b60593d6705a5160c92de6f186dfef784a
SHA51225921db9d542af8caa62145d43e699c095f324a1020e5fe13943748f093d165240443e2520c5e5352a171697b60f0ca73be603430cee64c8c2db1df8d3dc0239