Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
08/12/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
d4efdf88092c56fce0c9234f7643fe00
-
SHA1
b07aca8a004b9881bcff391b641bef44b0abd078
-
SHA256
e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96
-
SHA512
8888211c489e16f4f72f5b873fd67a6ff7231ce3a1c5b293067d11a9139707aec1f4d8ef2ba0b31dd68f5610244bb37cb22e180a0a859dccfe16e58b323dcf1a
-
SSDEEP
24576:ypSSRhZFvsEBFumx8eDmCfPVLHhz3eAD4pbSHw/cDKgM3Ty+Kk:ypSS7AEBF8eDPNHNxMbSHw/eKgST1Z
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader First Stage 1 IoCs
resource yara_rule behavioral1/files/0x0006000000016d6b-45.dat modiloader_stage1 -
Executes dropped EXE 1 IoCs
pid Process 2140 INS9A8B.tmp -
Loads dropped DLL 7 IoCs
pid Process 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 2140 INS9A8B.tmp 2140 INS9A8B.tmp 2140 INS9A8B.tmp 2140 INS9A8B.tmp 2140 INS9A8B.tmp 2140 INS9A8B.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\xSharez Scanner 3\is-4VLFO.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-DRVRM.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-0D9JI.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-731HN.tmp INS9A8B.tmp File opened for modification C:\Program Files (x86)\xSharez Scanner 3\unins000.dat INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\unins000.dat INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\languages\is-1IIO2.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\languages\is-J46T6.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-HQFO7.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\languages\is-UK6B2.tmp INS9A8B.tmp File opened for modification C:\Program Files (x86)\xSharez Scanner 3\unins000.exe INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-EAQ8A.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\languages\is-RTBSN.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\languages\is-FNAO6.tmp INS9A8B.tmp File created C:\Program Files (x86)\xSharez Scanner 3\is-IEB0D.tmp INS9A8B.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INS9A8B.tmp -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2140 INS9A8B.tmp Token: SeBackupPrivilege 2140 INS9A8B.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2140 2128 d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\INS9A8B.tmpC:\Users\Admin\AppData\Local\Temp\INS9A8B.tmp /SL3 $30130 C:\Users\Admin\AppData\Local\Temp\d4efdf88092c56fce0c9234f7643fe00_JaffaCakes118.exe 1070831 1074277 655362⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD58c0e2b408af6dc79c4e0252988097e14
SHA1a0973fb6985d3c959448ba4ec3476339f30eb97b
SHA25606e98db809d9d7785ced0d149d20a3c8fa943371446439e3c1d18983cb885249
SHA512d05e7fc17da4eed2138802b5f93fbcd64040a26da96219269c49399dcf955dbac9d909eac6888c0942873744e72548efbe94bf2893ec7c45fb664347c44435ae
-
Filesize
64KB
MD54aa2479ed0c28e1941a3160ff5eacba1
SHA1302067290cd0873a38dec6986fe609b149c77ca4
SHA2564b34c348e526408d33bc4a47cec8c8bc0fe6698bef86089654b8ea77c9e7d39c
SHA512b280d024e9a87e9451f4d14bdbad6a82c44dfbde983d9dd1953ee898aba1a404730393bb4efcecd8279458130dbb524f76e609c28b8319265fa867dab33d5881
-
Filesize
1.5MB
MD5b802e159ed7deffb96eff2c62f711a40
SHA19e47fea853dd8c6346fc77d34952b6d57d71aace
SHA25687cb8763dc50a6c84430bb259280b86bb63725ae90354b7253363a71fe164fea
SHA512e8aa81769c0fd2f287f41fec2240ed637860ad99130c4c0c5d26eb41cc126520312fe6eb8a0bcb118bed7c7aaff93ea5a43597e4125f49e8cfda313cd4ac1bb6
-
Filesize
481KB
MD58a9dd2367a2ea516265e256259d3ddbd
SHA1f28f99914149bbb2cba8747bc67a06b36ac96d15
SHA256af7200ba3f315a97fbbb2a61c24c6069fbac22e9a4014b8e92b19344a8bef989
SHA5126f4cfb824a473826e1b1ac448820a81559479eba6ddbc535b8a7aa393f98053549c24716c9aec8e105f68fc4d32d489a878539ed4b5668ee06a29289b3a7fca8
-
Filesize
32KB
MD559a7e0fa5404db5e9f1f18e2a2f69797
SHA143045d5102ad7e552e0c674dcddbd6f3e207fb62
SHA2565bcc823ba75c9bf6a8e01101eb5cee690fd3dcb2d635432ad4e26bf76024954c
SHA512296671e7082dbde345f5a92af947c56ac5c73eefe9c47606347ac55a54864675e038d70ed4efc01623fd9780eaa2d49dad68474e294704bcccc8333e3a0a41f2
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3