Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 14:20

General

  • Target

    cd737dd6ef2be306cf406249af91d7e0_JaffaCakes118.exe

  • Size

    264KB

  • MD5

    cd737dd6ef2be306cf406249af91d7e0

  • SHA1

    423a4dcf14b04a60cfe3da2b6755296d71b0104a

  • SHA256

    f58c07af381260020c450baa75bd7982dafaf19c263713aee18074a96998e70c

  • SHA512

    b13d18b5cfe8d9d0809b259e4e54083675fcd3e82065601f53bf7781d9e08f16a21044e5de275d42fdd588d593bfb1b65fc28125035a94ad486095dcb57730ed

  • SSDEEP

    6144:d02c94nYY+uUMFemOFu3Ksm2Yn+EE9j+ivEyPYxJQeyE:aSnYPweZnl+EER+iv6IeyE

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
  • ModiLoader Second Stage 61 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd737dd6ef2be306cf406249af91d7e0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cd737dd6ef2be306cf406249af91d7e0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\cd737dd6ef2be306cf406249af91d7e0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\cd737dd6ef2be306cf406249af91d7e0_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2900
  • C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" javascript:LH0ETiD="Lzb3YQ";wL3=new%20ActiveXObject("WScript.Shell");GUVmAw4A="Hj";GFd3A=wL3.RegRead("HKLM\\software\\Wow6432Node\\EBTEt4NHXc\\VeswEGNlt");QjOt1="ZUmGk";eval(GFd3A);R7Q3WcMd="UDZy5lD";
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:ambgfe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe
        3⤵
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VirtualBox drivers on disk
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Deletes itself
        • Drops startup file
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\433fb8\240497.bat

    Filesize

    61B

    MD5

    1d06860b64c4072361d52f6a00c431ca

    SHA1

    db14a9606b1890be159fcee77408318872015d08

    SHA256

    2c651141246b4d81ff4ee6cc84ffb5625bead8968fb9f2112d6ba969461d7947

    SHA512

    6d76ff1f738c611f8f8f269c60ee9440e85b80517226f27d87c279e0d05f0682e71a48b8d176da69be34fd6e7d5102d7e3ba153c6209218f714056fb0c857a11

  • C:\Users\Admin\AppData\Local\433fb8\9e8496.lnk

    Filesize

    877B

    MD5

    d56818f91e4463401cfdb7a2f9c8b1fb

    SHA1

    ea29bb325a7ab1c2ac5ddb298a7fecfb459f3ce2

    SHA256

    8737fd6bc443d36768f38bf8b8037fd33acde6c30a2df68f32aa2af6ceabdb86

    SHA512

    66cba8e12cec9cdc6452ef3633b71f22ca28db30e104e09f829291ef3fce9fc8a6a285b79b0b144e952116c146782d5cc373ad4ed2654ecaf9940b15c095e2f8

  • C:\Users\Admin\AppData\Local\433fb8\ab2c43.21b5e51

    Filesize

    10KB

    MD5

    36a756519668243fd862916886cd97e5

    SHA1

    6fab0ac6eb2ca25af534ff603d14cab57d87836f

    SHA256

    5acf69d3b48c468b7b65d39d901d3a7c3ac74ae19d9de33fecc317623524be58

    SHA512

    46ee3310c96b9da80adfcf1584fbd45e37e25999b9efa6ac1ab32f923858e4fe72ed60f06661ab35fe04f5c4ec4945bee4ad8c25b2cf501f17ce88752e9aadd0

  • C:\Users\Admin\AppData\Roaming\5ac6dc\097814.21b5e51

    Filesize

    26KB

    MD5

    5e3fd07c0e095d392af5c05a626f8962

    SHA1

    6f31230c6cfad8efa8c1f86c0d62d21e43137d08

    SHA256

    b98c74652d9ea861eca00f75f3688274ce1f71086f120432e1f9cc316d440509

    SHA512

    7d74879593a04d81f5d75d5a090a9fea53caead1cc210170f8ccb1461a5ee369f2a2172ea546e753bf92b491688962a9b51ad5a96d579534465ca3cf07552177

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b719cc.lnk

    Filesize

    987B

    MD5

    3a0919acb4a5390d67792162b211902b

    SHA1

    481b2059b1b3e5c106e713f86723e65b03d49aef

    SHA256

    6947ca2bc3deedec3e1b4af6806a3b0c6e7a01a8b99abd83b323785d3ada1327

    SHA512

    eafe825437b4b8422cff54f85aeedb77d1f781a73ead0e9f085de37a290e674f518e5a2cda1002ffc94ab54e2bb9a78aead06054d9432c5e7c0198447483e5d5

  • memory/1676-47-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-45-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-24-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-48-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-49-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-50-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-31-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-30-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-29-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-28-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-33-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-35-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-34-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-67-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-46-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-32-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-44-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-43-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-42-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-41-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-40-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-39-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-38-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-37-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-36-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-55-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-57-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-25-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-58-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-63-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-64-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1676-66-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-85-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-87-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-78-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-77-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-76-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-75-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-74-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-73-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-80-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-79-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-81-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-82-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-83-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-84-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/1692-86-0x0000000000200000-0x0000000000341000-memory.dmp

    Filesize

    1.3MB

  • memory/2828-26-0x0000000002F70000-0x0000000004F70000-memory.dmp

    Filesize

    32.0MB

  • memory/2828-23-0x0000000006220000-0x00000000062F6000-memory.dmp

    Filesize

    856KB

  • memory/2828-27-0x0000000006220000-0x00000000062F6000-memory.dmp

    Filesize

    856KB

  • memory/2900-2-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2900-5-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2900-4-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2900-6-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2900-7-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-11-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-8-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-12-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-10-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-9-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB

  • memory/2900-13-0x0000000001CB0000-0x0000000001D86000-memory.dmp

    Filesize

    856KB