Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe
-
Size
894KB
-
MD5
ccafbc0dc9af3a1e10cf69eea429fb96
-
SHA1
884a0a8d8b4c0f165b56f831e953f05082ab08a3
-
SHA256
c3d8ab3258f3a6c98fd4da79c60973a1c0989e39811920b96847812a29e50aa1
-
SHA512
bbd36de70d7820da19dc8666bed2e26ba010aafe8448db9201ded2b9152a90e18e6311649c630ae30884ac6629e57a24d14db64c598f2abfb2e1996fdb0d88c5
-
SSDEEP
12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2/ExgDj48uSeJro0okzLPs:YKwQrsiK3Sr0ckHCb2Mxg348uS8oqzLE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE -
ModiLoader Second Stage 22 IoCs
resource yara_rule behavioral2/memory/3816-3-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3816-4-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3816-7-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3816-6-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3816-16-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-25-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-27-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-39-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-40-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-43-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-46-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-49-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-52-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-55-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-58-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-61-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-64-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-67-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-70-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-73-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-76-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/3412-79-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE -
Executes dropped EXE 2 IoCs
pid Process 1132 mstwain32.exe 3412 mstwain32.EXE -
Loads dropped DLL 4 IoCs
pid Process 3412 mstwain32.EXE 3412 mstwain32.EXE 3412 mstwain32.EXE 3412 mstwain32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.EXE" mstwain32.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1132 mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1204 set thread context of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1132 set thread context of 3412 1132 mstwain32.exe 87 -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\mstwain32.exe ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE File opened for modification C:\Windows\mstwain32.exe ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE File opened for modification C:\Windows\mstwain32.EXE mstwain32.exe File created C:\Windows\ntdtcstp.dll mstwain32.EXE File created C:\Windows\cmsetac.dll mstwain32.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3816 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE Token: SeBackupPrivilege 4084 vssvc.exe Token: SeRestorePrivilege 4084 vssvc.exe Token: SeAuditPrivilege 4084 vssvc.exe Token: SeDebugPrivilege 3412 mstwain32.EXE Token: SeDebugPrivilege 3412 mstwain32.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 1132 mstwain32.exe 1132 mstwain32.exe 3412 mstwain32.EXE 3412 mstwain32.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 1204 wrote to memory of 3816 1204 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe 82 PID 3816 wrote to memory of 1132 3816 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE 86 PID 3816 wrote to memory of 1132 3816 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE 86 PID 3816 wrote to memory of 1132 3816 ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE 86 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 PID 1132 wrote to memory of 3412 1132 mstwain32.exe 87 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXEccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\ccafbc0dc9af3a1e10cf69eea429fb96_JaffaCakes118.EXE"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\mstwain32.EXEmstwain32.EXE4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3412
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4084
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD577bc9f1ab14b24ebf03c4ee0806acb6f
SHA19573b70520eecbbab92d6d39196db97bcfdc65f0
SHA25694cc5bad36551df45a58fdc26fbb1200e1123e1d0df4af24b452b11c8e51513c
SHA5122d9e767adf1464987f4808ca6b91155626c0036cb7e10b457f49683e383244873803f470b10dbf0910442ea7cd41cb7c90f73ad2fa863fb1963dddb654752233
-
Filesize
894KB
MD5ccafbc0dc9af3a1e10cf69eea429fb96
SHA1884a0a8d8b4c0f165b56f831e953f05082ab08a3
SHA256c3d8ab3258f3a6c98fd4da79c60973a1c0989e39811920b96847812a29e50aa1
SHA512bbd36de70d7820da19dc8666bed2e26ba010aafe8448db9201ded2b9152a90e18e6311649c630ae30884ac6629e57a24d14db64c598f2abfb2e1996fdb0d88c5
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
14B
MD5b7e8e583a34d4d59a3fa6d5ca7d9c3cb
SHA157056a74b70e0e5f616096cfef0f599e06931f52
SHA256590355785ceb06d2f608ca3b276b8bdc3207119d296b97bb796829eeff016157
SHA512aa05853ded06beb245fd840057fe8dc8eead9344327b5a1c014a0a63407b48af21f0bf0d94c7ee994cea0014e5910043a7b6d9b57f29893d89df30c23676c224