Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe
-
Size
181KB
-
MD5
ccb09b6e9134bab23f215fd2056ca347
-
SHA1
c1ea45bb46a24bd65312a45eb86ce982936fdcf3
-
SHA256
4841145d3c19307932d092cf606fcada5d1c30c1ce7cddc4bc84fa60f79c8bd7
-
SHA512
dd63da352d1f85662436a96645e9218cb82bc3db647dc1326a3006c7742800ce6130f7e2eff42777d89964bf1347f72787915df028835bd762dea1041d311f29
-
SSDEEP
3072:8Z2xvc3PcSnZ1pPHA3v0goBIX0GLmCljv1RFfchDjCmJIEgsKW//4ly+Gh7Lel8M:9xU3P7Z1ZgcwXy+juhDDaEgsN//4SVLm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
ModiLoader Second Stage 22 IoCs
resource yara_rule behavioral2/memory/1388-6-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/1388-7-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/1388-20-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-30-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-32-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-46-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-47-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-51-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-54-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-57-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-60-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-63-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-66-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-69-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-72-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-75-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-81-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/2580-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 1352 rundll32.exe 2580 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Windows\\rundll32.exe" rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4456 set thread context of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 1352 set thread context of 2580 1352 rundll32.exe 89 -
resource yara_rule behavioral2/memory/1388-3-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1388-5-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1388-6-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1388-7-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1388-20-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-29-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-30-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-32-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-46-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-47-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-51-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-54-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-57-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-60-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-63-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-66-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-69-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-72-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-75-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-81-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/2580-87-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\rundll32.exe rundll32.exe File created C:\Windows\ntdtcstp.dll rundll32.exe File created C:\Windows\cmsetac.dll rundll32.exe File created C:\Windows\rundll32.exe ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe File opened for modification C:\Windows\rundll32.exe ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1388 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe Token: SeBackupPrivilege 2404 vssvc.exe Token: SeRestorePrivilege 2404 vssvc.exe Token: SeAuditPrivilege 2404 vssvc.exe Token: SeDebugPrivilege 2580 rundll32.exe Token: SeDebugPrivilege 2580 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 1352 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 4456 wrote to memory of 1388 4456 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 83 PID 1388 wrote to memory of 1352 1388 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 88 PID 1388 wrote to memory of 1352 1388 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 88 PID 1388 wrote to memory of 1352 1388 ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe 88 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 PID 1352 wrote to memory of 2580 1352 rundll32.exe 89 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\rundll32.exe"C:\Windows\rundll32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\ccb09b6e9134bab23f215fd2056ca347_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\rundll32.exeC:\Windows\rundll32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2580
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\699c4b9cdebca7aaea5193cae8a50098_755b0f1a-bb38-4bb2-bc7e-240c892146ee
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
33KB
MD5e2026eb00cb698b4e4151125e0862705
SHA16f09cab132814e43e5dedb8cfbdcc40292b21ddd
SHA256ba9cd31edcb0648431fe7f1a0efea753c7a1e936dd08d64b14a1bc0eb9428422
SHA512778e1e25076884f2b4f438cf55c1a12e8635045b01aa709507c41e14d9729162b26dfcd1aca62fdce4fcbec50acc2184979f809735292405bb32e302ba6f0bcc
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
181KB
MD5ccb09b6e9134bab23f215fd2056ca347
SHA1c1ea45bb46a24bd65312a45eb86ce982936fdcf3
SHA2564841145d3c19307932d092cf606fcada5d1c30c1ce7cddc4bc84fa60f79c8bd7
SHA512dd63da352d1f85662436a96645e9218cb82bc3db647dc1326a3006c7742800ce6130f7e2eff42777d89964bf1347f72787915df028835bd762dea1041d311f29