Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 14:10

General

  • Target

    d771086169826aa64c01a037c499fee2_JaffaCakes118.exe

  • Size

    83KB

  • MD5

    d771086169826aa64c01a037c499fee2

  • SHA1

    09e0218055718f001b04160b60f8e5950c14022c

  • SHA256

    370282e3a32b36f33d36b51fa714fa82a094891233c3095af72a0ee301bdaee7

  • SHA512

    31473e619354229b70f668aa4c0ae99284416fbf08ae62ddb0603b43a2adbf34201e25210abfa735a03e04c38b3d86cd21dd764f33567a0c89c687d4d18abe21

  • SSDEEP

    1536:WQSSJwFrk4VsRL/q3NkXVj2dqgvVEzRSUqlvmQu6Lyo5j:WQU16L/q3eVP2EzRl0yo5j

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 3 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d771086169826aa64c01a037c499fee2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d771086169826aa64c01a037c499fee2_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\SysWOW64\intenat.exe
      C:\Windows\system32\intenat.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\Deleteme.bat
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Deleteme.bat

    Filesize

    147B

    MD5

    0c358821022fb449244e141497caa47d

    SHA1

    f9a05db1933b803053e9d0b09e83d52586acbedb

    SHA256

    cc305e163a0dab9622adbd2e6d80609ef399750b1837398c74b7bdcd43e25bf3

    SHA512

    3de632ee3959e3535fc033393a94ec74465f917c59860a0b9b108ac0c9835e3b0b7348d01fc9e3cf5bc41c5945b90d826fe93bbd5ec4e063bc995f18a0dacca7

  • C:\Windows\SysWOW64\intenat.exe

    Filesize

    83KB

    MD5

    d771086169826aa64c01a037c499fee2

    SHA1

    09e0218055718f001b04160b60f8e5950c14022c

    SHA256

    370282e3a32b36f33d36b51fa714fa82a094891233c3095af72a0ee301bdaee7

    SHA512

    31473e619354229b70f668aa4c0ae99284416fbf08ae62ddb0603b43a2adbf34201e25210abfa735a03e04c38b3d86cd21dd764f33567a0c89c687d4d18abe21

  • C:\Windows\SysWOW64\key.dll

    Filesize

    17KB

    MD5

    85464ff6a9f5bebb9c6f064e9c03fce1

    SHA1

    976b95915789a367569e4148c0ca22aa33e82db7

    SHA256

    71670e605d3bb61d042c932a0d8871af0f2953be6b92f9628e19e27e96988399

    SHA512

    e28e5f20ad450c74a0f81350c1fcb41785280d2f957d3d4b56aa9b9602431cfd38a56b8e8c6701e96f86a2d0b51f8219858b10eebb577e5542ab9d7bb2b815ec

  • memory/2024-15-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2024-24-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2024-23-0x0000000000220000-0x000000000022B000-memory.dmp

    Filesize

    44KB

  • memory/2596-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2596-13-0x0000000000220000-0x000000000023D000-memory.dmp

    Filesize

    116KB

  • memory/2596-14-0x0000000000220000-0x000000000023D000-memory.dmp

    Filesize

    116KB

  • memory/2596-26-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB