Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
08/12/2024, 11:57
Static task
static1
Behavioral task
behavioral1
Sample
d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
-
Size
447KB
-
MD5
d6ede113188b8c9054d1174cfd2bd433
-
SHA1
b3409da93b849751ef1468df54bd5706879fb4be
-
SHA256
7f4f1ac1695aafd0abc0d000f70ed1b75534d36f149115186abafa3ba059f20a
-
SHA512
2f55aec1bbe93e2144819fc5da3b538f020c591772dd8f2322011f002010482d6c5c171e385b8ce34d9fa5f45666c0443aa3a1cedd73138c01e6b535bd6405a9
-
SSDEEP
12288:3s6Gedq//5Hd0a8uHVFIpqnUrEYxUt8MBGhMiIlBv:Ct//s1uHVqwnqEYxUt8ccjIlBv
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral1/memory/2128-5-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2088-15-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2088-19-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2128-26-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2128-35-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2088-37-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 behavioral1/memory/2088-38-0x0000000000400000-0x0000000000530200-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 3024 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2088 kaspersky.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2088 set thread context of 2568 2088 kaspersky.exe 31 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\_kaspersky.exe kaspersky.exe File opened for modification C:\Program Files\_kaspersky.exe kaspersky.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\kaspersky.exe d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe File opened for modification C:\Windows\kaspersky.exe d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe File created C:\Windows\SetupDel.bat d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2936 2088 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaspersky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2088 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2088 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2088 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 30 PID 2128 wrote to memory of 2088 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2568 2088 kaspersky.exe 31 PID 2088 wrote to memory of 2936 2088 kaspersky.exe 32 PID 2088 wrote to memory of 2936 2088 kaspersky.exe 32 PID 2088 wrote to memory of 2936 2088 kaspersky.exe 32 PID 2088 wrote to memory of 2936 2088 kaspersky.exe 32 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33 PID 2128 wrote to memory of 3024 2128 d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\kaspersky.exeC:\Windows\kaspersky.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵PID:2568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 2803⤵
- Program crash
PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\SetupDel.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD529fa96c47b626e0e9e7db5422b87cb49
SHA1601f302f183afcb29ac25801b4a21db8aab2e35e
SHA2561088fa281076330c73be3065d0cede69dfef0a87c12961539f95cedac3bca3ec
SHA5120cd09a9e52b30c94a9e5c420a3b7ba9b5f347d16b48d7bfad7382f5e808fe5fcc1b7ed2ab9dae0acf3336415cad93889cd6700308fd541c9b0ebe075bf526b42
-
Filesize
447KB
MD5d6ede113188b8c9054d1174cfd2bd433
SHA1b3409da93b849751ef1468df54bd5706879fb4be
SHA2567f4f1ac1695aafd0abc0d000f70ed1b75534d36f149115186abafa3ba059f20a
SHA5122f55aec1bbe93e2144819fc5da3b538f020c591772dd8f2322011f002010482d6c5c171e385b8ce34d9fa5f45666c0443aa3a1cedd73138c01e6b535bd6405a9