Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 13:25
Behavioral task
behavioral1
Sample
cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe
-
Size
534KB
-
MD5
cd3ba1700710ebbceea51b6b49cada5b
-
SHA1
481ae12d396fb6e44209e328d3c54756710e43e1
-
SHA256
d8242255fced86d7dda9ee9335e73e135a86e0a886288ee8eaf86ba25c7e29b8
-
SHA512
7b229bdcce274a5465d9da1b31f99d35394f5591b85cdf827bef5e0b8d27fea5f15a18404d412935d4e6df4e4ebb21c98b95040e0af2072a32a0df59787b4552
-
SSDEEP
12288:QBMmKGnhDT+JlCKgI08gnwUBVzsSMhcEKFZNylA8LFR3Gb:CMmnDC+IgJneKlyPFm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 19 IoCs
resource yara_rule behavioral2/memory/4916-2-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4916-3-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4916-4-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4916-5-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4916-16-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-22-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-24-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-36-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-37-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-42-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-47-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-52-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-57-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-62-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-67-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-72-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-77-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-82-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/436-87-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 1404 mstwain32.exe 436 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 436 mstwain32.exe 436 mstwain32.exe 436 mstwain32.exe 436 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
AutoIT Executable 24 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3496-1-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-18-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-19-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-23-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-40-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-41-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-45-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-46-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-50-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-51-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-55-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-56-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-60-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-61-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-65-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-66-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-70-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-71-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-75-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-76-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-80-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-81-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/3496-85-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe behavioral2/memory/1404-86-0x0000000000400000-0x00000000004A8000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3496 set thread context of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 1404 set thread context of 436 1404 mstwain32.exe 92 -
resource yara_rule behavioral2/memory/3496-0-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-1-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/files/0x000400000001db4f-10.dat upx behavioral2/memory/3496-18-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-19-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-23-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-40-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-41-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-45-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-46-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-50-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-51-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-55-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-56-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-60-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-61-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-65-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-66-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-70-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-71-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-75-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-76-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-80-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-81-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/3496-85-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral2/memory/1404-86-0x0000000000400000-0x00000000004A8000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4916 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe Token: SeBackupPrivilege 4828 vssvc.exe Token: SeRestorePrivilege 4828 vssvc.exe Token: SeAuditPrivilege 4828 vssvc.exe Token: SeDebugPrivilege 436 mstwain32.exe Token: SeDebugPrivilege 436 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 436 mstwain32.exe 436 mstwain32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 3496 wrote to memory of 4916 3496 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 82 PID 4916 wrote to memory of 1404 4916 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 91 PID 4916 wrote to memory of 1404 4916 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 91 PID 4916 wrote to memory of 1404 4916 cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe 91 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 PID 1404 wrote to memory of 436 1404 mstwain32.exe 92 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd3ba1700710ebbceea51b6b49cada5b_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:436
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4828
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5a71eed9f33ab3dfde1f018b0913372ac
SHA1a91f3311c33da1cbf3a1e10b973f660cc2c8bb3a
SHA25649d785795c17016cca224aa61815ff4e5eafcb24c393669284ff13598bd86080
SHA512cf378e24586bf7029c2a20b2b9a800816d1efc0e12b0338e3284133edd51878e41c9f27b195f6e4b341e35e9b7b8ce76c78c982d557d7b42018428dc6df8a9de
-
Filesize
534KB
MD5cd3ba1700710ebbceea51b6b49cada5b
SHA1481ae12d396fb6e44209e328d3c54756710e43e1
SHA256d8242255fced86d7dda9ee9335e73e135a86e0a886288ee8eaf86ba25c7e29b8
SHA5127b229bdcce274a5465d9da1b31f99d35394f5591b85cdf827bef5e0b8d27fea5f15a18404d412935d4e6df4e4ebb21c98b95040e0af2072a32a0df59787b4552
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350