Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2024, 00:17

General

  • Target

    cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe

  • Size

    155KB

  • MD5

    cfbf91ee3e6afdbf2d5c6138158e5c2e

  • SHA1

    c1f43621d767c4a41e0df6f385c895ced71af495

  • SHA256

    bffdf0531575427b7d592819ba66cb808dd22d91b123be9dcc2f05649f7663e2

  • SHA512

    0d52570d081044adc1743232a9fabc1bee76b7a179363d627a7a0be6cb24480930254a372ec392a9e4beebeb1a34f641a137f0570e6529d5df15d74d3110caac

  • SSDEEP

    3072:eSMt+tk5U4VYmEYGZuAS4876FRAKtCLICXpTq3cwOmeVD:Qtkk5U6YTgAS/6wguXAs8eF

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 13 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe.exe"
      2⤵
      • Executes dropped EXE
      PID:1176
    • C:\Users\Admin\AppData\Local\Temp\test.exe
      "C:\Users\Admin\AppData\Local\Temp\test.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cfbf91ee3e6afdbf2d5c6138158e5c2e_JaffaCakes118.exe.exe

    Filesize

    16KB

    MD5

    2a996d7cc35fe21d19fa868c8a1dfd49

    SHA1

    8f6b663e0761921c40bb7530137305461e62db66

    SHA256

    e4cf66ab479685b41ccbddd33c8f292108784553a9c6a017598111955f7817e7

    SHA512

    65d56536d291279a252ac5c4e0065dd4fe29c786b27e0fe465f7c70a33aa209757b2f4a9230b536599456ab1e50d3e8e4598f7150af0f08b56df61469f7a8ad9

  • \Users\Admin\AppData\Local\Temp\cmsetac.dll

    Filesize

    33KB

    MD5

    d2b20db3f5352befbf6d2a38f3dd8d5c

    SHA1

    25cdc577ac81bca03def5b34916d4ffd81444604

    SHA256

    ef61b13e879b9ddacff5a073a53640b485951931fc68c6399fa6ffacaa91c5f6

    SHA512

    474a35c11a80f6bfb3718a520b89f8d747f4ac1e0ca9bda66c34a0692e08d8e0d4841c1931035faa4ccebc14fa26dac660331278d4a0696b59d8704092771435

  • \Users\Admin\AppData\Local\Temp\ntdtcstp.dll

    Filesize

    7KB

    MD5

    67587e25a971a141628d7f07bd40ffa0

    SHA1

    76fcd014539a3bb247cc0b761225f68bd6055f6b

    SHA256

    e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

    SHA512

    6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

  • \Users\Admin\AppData\Local\Temp\test.exe

    Filesize

    108KB

    MD5

    b33d6aced27ea175307a57d321a95b1d

    SHA1

    8696dbd0d54355e9691ea4b3fc1342c44b9e94fa

    SHA256

    6610090c9c0e58e9121f9a5545ab2e17881ad5c43b2cdd8650b1c1b97b3d535d

    SHA512

    ee6ad49bda1339e1a6d5feb8c8e265311d8f951536a5621b842db802528983a4a6352fb5a9597c71abe81f7c1a71e769ebde9a0541d4eb19de3ece8a7c7e172f

  • memory/1176-7755-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1176-834-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1176-18-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/1712-2662-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-30-0x00000000034B0000-0x0000000003500000-memory.dmp

    Filesize

    320KB

  • memory/1712-13-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

    Filesize

    68KB

  • memory/1712-12844-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-702-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

    Filesize

    68KB

  • memory/1712-29-0x00000000034B0000-0x0000000003500000-memory.dmp

    Filesize

    320KB

  • memory/1712-835-0x00000000034B0000-0x0000000003500000-memory.dmp

    Filesize

    320KB

  • memory/1712-6445-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-1357-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-3837-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-5142-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1712-9-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

    Filesize

    68KB

  • memory/1900-6577-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-7885-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-1361-0x0000000000B50000-0x0000000000B5E000-memory.dmp

    Filesize

    56KB

  • memory/1900-1359-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-1360-0x0000000000840000-0x0000000000848000-memory.dmp

    Filesize

    32KB

  • memory/1900-5274-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-1226-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-3969-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-42-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1900-2664-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-9061-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-10366-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-11671-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-59-0x0000000000B50000-0x0000000000B5E000-memory.dmp

    Filesize

    56KB

  • memory/1900-12976-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-14281-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1900-15587-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB