Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/12/2024, 11:59
Behavioral task
behavioral1
Sample
d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe
-
Size
180KB
-
MD5
d9835832bcd07965d05527ca1f8b1f9e
-
SHA1
9901467c1e3ada1bcb93d9397312ae119fc49415
-
SHA256
de10503862cb62c6a7af3ec741b8428deb394623ae2fc64d8ee2173939742f0c
-
SHA512
c30f2b3f46119c7f0aa5d254ac9041e96a4ed6a46effee74b940e9fe51988b54624d2155f8cc0543001d79e845cf8abe867a1e647154b1c790e3ef939c7e68bc
-
SSDEEP
3072:tzTkTvP9ghCeEMhWITr9pi4z1RNSs50R/CyV5Bc8z7bZBryZ5M:tzwH9g4zI/Xi4zVjQVg23fyA
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral2/memory/2076-10-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-12-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-13-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-14-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-15-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-16-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-17-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-18-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-19-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-20-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-21-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-22-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-23-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-24-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-25-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 behavioral2/memory/5052-26-0x0000000000400000-0x000000000046D000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 5052 javascheds.exe -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SunJavaUpdateSched.lnk d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SunJavaUpdateSched.lnk d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SunJavaUpdateSched.lnk javascheds.exe -
Executes dropped EXE 1 IoCs
pid Process 5052 javascheds.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: javascheds.exe File opened (read-only) \??\I: javascheds.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wins\setup\javascheds.exe d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wins\setup\javascheds.exe d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2076-0-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/files/0x0007000000023c67-5.dat upx behavioral2/memory/2076-10-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-12-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-13-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-14-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-15-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-16-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-17-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-18-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-19-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-20-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-21-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-22-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-23-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-24-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-25-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/5052-26-0x0000000000400000-0x000000000046D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javascheds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2076 d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe 2076 d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe 5052 javascheds.exe 5052 javascheds.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2076 wrote to memory of 5052 2076 d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe 83 PID 2076 wrote to memory of 5052 2076 d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe 83 PID 2076 wrote to memory of 5052 2076 d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe 83 PID 5052 wrote to memory of 3012 5052 javascheds.exe 85 PID 5052 wrote to memory of 3012 5052 javascheds.exe 85 PID 5052 wrote to memory of 3012 5052 javascheds.exe 85 PID 5052 wrote to memory of 2196 5052 javascheds.exe 86 PID 5052 wrote to memory of 2196 5052 javascheds.exe 86 PID 5052 wrote to memory of 2196 5052 javascheds.exe 86 PID 5052 wrote to memory of 2020 5052 javascheds.exe 87 PID 5052 wrote to memory of 2020 5052 javascheds.exe 87 PID 5052 wrote to memory of 2020 5052 javascheds.exe 87 PID 3012 wrote to memory of 1684 3012 cmd.exe 91 PID 3012 wrote to memory of 1684 3012 cmd.exe 91 PID 3012 wrote to memory of 1684 3012 cmd.exe 91 PID 2196 wrote to memory of 2672 2196 cmd.exe 92 PID 2196 wrote to memory of 2672 2196 cmd.exe 92 PID 2196 wrote to memory of 2672 2196 cmd.exe 92 PID 2020 wrote to memory of 3148 2020 cmd.exe 93 PID 2020 wrote to memory of 3148 2020 cmd.exe 93 PID 2020 wrote to memory of 3148 2020 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d9835832bcd07965d05527ca1f8b1f9e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\wins\setup\javascheds.exe"C:\Windows\system32\wins\setup\javascheds.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll4⤵
- System Location Discovery: System Language Discovery
PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx4⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEdit4ISB.dll3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEdit4ISB.dll4⤵
- System Location Discovery: System Language Discovery
PID:3148
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5d9835832bcd07965d05527ca1f8b1f9e
SHA19901467c1e3ada1bcb93d9397312ae119fc49415
SHA256de10503862cb62c6a7af3ec741b8428deb394623ae2fc64d8ee2173939742f0c
SHA512c30f2b3f46119c7f0aa5d254ac9041e96a4ed6a46effee74b940e9fe51988b54624d2155f8cc0543001d79e845cf8abe867a1e647154b1c790e3ef939c7e68bc