Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe
-
Size
616KB
-
MD5
d0609227b5bf4fa7829e61e3ef44a2ce
-
SHA1
d511e9ee5021cd6fa7d86e10ce08c457ce7abd8e
-
SHA256
e7f18fc8bcba2e12a856829c95ad5a88607b6ffa4ce081b046cc2107ca094981
-
SHA512
346766ba01b863539cfa7666a5d045b6ac819a01273935636ab2126b4a5082feeb0ed953b29d9c83aa7617464ac240d3dcbff8a47173a87cc2c4f2309c7bcef2
-
SSDEEP
12288:wEoamJ4b7x+36taaj0ZbQvls57TF3Z4mxxA/zll/EpM/Mv:wJamJoOALoQvlUfQmXkzM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral2/memory/1948-5-0x0000000000400000-0x0000000000567000-memory.dmp modiloader_stage2 behavioral2/memory/1948-8-0x0000000000400000-0x0000000000567000-memory.dmp modiloader_stage2 behavioral2/memory/1948-9-0x0000000000400000-0x0000000000567000-memory.dmp modiloader_stage2 behavioral2/memory/1948-19-0x0000000000400000-0x0000000000567000-memory.dmp modiloader_stage2 behavioral2/memory/3836-21-0x0000000000400000-0x0000000000567000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 3836 csrss.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\_csrss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\_csrss.exe csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3836 set thread context of 2524 3836 csrss.exe 83 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\csrss.exe d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\csrss.exe d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 340 2524 WerFault.exe 83 1312 3836 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1948 wrote to memory of 3836 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 82 PID 1948 wrote to memory of 3836 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 82 PID 1948 wrote to memory of 3836 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 82 PID 3836 wrote to memory of 2524 3836 csrss.exe 83 PID 3836 wrote to memory of 2524 3836 csrss.exe 83 PID 3836 wrote to memory of 2524 3836 csrss.exe 83 PID 3836 wrote to memory of 2524 3836 csrss.exe 83 PID 3836 wrote to memory of 2524 3836 csrss.exe 83 PID 3836 wrote to memory of 3516 3836 csrss.exe 85 PID 3836 wrote to memory of 3516 3836 csrss.exe 85 PID 1948 wrote to memory of 1940 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 90 PID 1948 wrote to memory of 1940 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 90 PID 1948 wrote to memory of 1940 1948 d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0609227b5bf4fa7829e61e3ef44a2ce_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\csrss.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\csrss.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\system32\calc.exe"3⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 124⤵
- Program crash
PID:340
-
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:3516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 6723⤵
- Program crash
PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""2⤵
- System Location Discovery: System Language Discovery
PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2524 -ip 25241⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3836 -ip 38361⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD5ab3068e2ec09a44ce8dbc3f5c92b2850
SHA11548ea5689687d7137a0c0ddc7bef19c2177c11f
SHA256c826bdf8f5214e4fd87d0784479ed80a91ac8890e5ea73e50b0dbe25bbc4ea50
SHA512d9579733d816f5fc30ab6a782a43da8bff6b367585893ebef30d34d66897a78ae6d560909b68eda1fd17cefc40a6f9d29ebe3016772ac2f2a4c0883ccd2bec72
-
Filesize
616KB
MD5d0609227b5bf4fa7829e61e3ef44a2ce
SHA1d511e9ee5021cd6fa7d86e10ce08c457ce7abd8e
SHA256e7f18fc8bcba2e12a856829c95ad5a88607b6ffa4ce081b046cc2107ca094981
SHA512346766ba01b863539cfa7666a5d045b6ac819a01273935636ab2126b4a5082feeb0ed953b29d9c83aa7617464ac240d3dcbff8a47173a87cc2c4f2309c7bcef2