Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe
-
Size
425KB
-
MD5
ce4e528e9bb19603f805e79a0f329feb
-
SHA1
15f5c065cea10073eb730b68244247956144bdfd
-
SHA256
4aee741a0b86dd6d89f06e840573792e2160dd5d998759ca1f9b438ba964b89c
-
SHA512
c8f0b79f33ab31003ae950d027b146ab99007cc6871a15a0b04f6230c9b57275371fd061d8c2bd0acd7f3f0659f16f44ba1d34318f95ab7ff5afec1f98200718
-
SSDEEP
6144:g2MjNWspjNHSkgPVXPJrnKPbLd0dlgHlt0sN2w6B/jj+tYvOf39:cUIVSdZhrnUbLKgFB0NS1ft
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 26 IoCs
resource yara_rule behavioral2/memory/4816-3-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4816-4-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4816-5-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4816-6-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4816-17-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-28-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-29-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-30-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-37-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-43-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-44-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-45-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-48-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-49-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-52-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-55-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-58-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-61-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-64-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-67-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-70-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-73-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-76-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-79-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-82-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/376-85-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 1532 mstwain32.exe 376 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 376 mstwain32.exe 376 mstwain32.exe 376 mstwain32.exe 376 mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1672 set thread context of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1532 set thread context of 376 1532 mstwain32.exe 89 -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\mstwain32.exe ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe File opened for modification C:\Windows\mstwain32.exe mstwain32.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4816 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe Token: SeBackupPrivilege 4492 vssvc.exe Token: SeRestorePrivilege 4492 vssvc.exe Token: SeAuditPrivilege 4492 vssvc.exe Token: SeDebugPrivilege 376 mstwain32.exe Token: SeDebugPrivilege 376 mstwain32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 1532 mstwain32.exe 376 mstwain32.exe 376 mstwain32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 1672 wrote to memory of 4816 1672 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 83 PID 4816 wrote to memory of 1532 4816 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 88 PID 4816 wrote to memory of 1532 4816 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 88 PID 4816 wrote to memory of 1532 4816 ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe 88 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 PID 1532 wrote to memory of 376 1532 mstwain32.exe 89 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\ce4e528e9bb19603f805e79a0f329feb_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:376
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4492
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3350944739-639801879-157714471-1000\02fc8fb78d4f7516019d9a99eaf6a46d_dd2803c7-d377-4f06-bdfe-aea230fc7b0e
Filesize50B
MD50d07aceef41f39fddc179b4cee5a6143
SHA18dc81dd6d1f4a8d2cd06a374ed2504aa087761b8
SHA256ae030038639228088c0ffd198200efad2f7f69f2ff909414ad2dbb6331d9a265
SHA5120fcb788f2122ee8101dfbbbffc55960a1df4e4b3054c0803ac0b2dc244fd28018951c874700c6d5d7a7433d301c860d44db1a24761b0c53b68e18df0c81caade
-
Filesize
33KB
MD5cbba09fc625ab21f3ee42503f88ac676
SHA15fa83bb72dbf5e9b96624bc503d2893ae597f8e0
SHA256017df95d10ea5a42cde7d18ee6ee6d922b6ed5e6f9ad10743bfca084c43d41c2
SHA512451bd2ad0665cf90e95f89804232e752eca125fe7f7685ef50a71aecfc15c3f41d1bcd796c24c1dc7769dd1ee47af87b24f34876822090caeec974583f9d6d24
-
Filesize
425KB
MD5ce4e528e9bb19603f805e79a0f329feb
SHA115f5c065cea10073eb730b68244247956144bdfd
SHA2564aee741a0b86dd6d89f06e840573792e2160dd5d998759ca1f9b438ba964b89c
SHA512c8f0b79f33ab31003ae950d027b146ab99007cc6871a15a0b04f6230c9b57275371fd061d8c2bd0acd7f3f0659f16f44ba1d34318f95ab7ff5afec1f98200718
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350