Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2024, 01:53

General

  • Target

    dc7901e832ae98140638c31eca8c5642_JaffaCakes118.exe

  • Size

    647KB

  • MD5

    dc7901e832ae98140638c31eca8c5642

  • SHA1

    1cc660f0b6430598d392cf5c914e95e0f301cb75

  • SHA256

    2813e62cf1d60e09bc576e4d3e58a4ec51367e374e07d0a72deeb887f2b30c09

  • SHA512

    c1bcb35c6c2204b60114c5a75149ccad9ae5983fba5a934fff8b6a314609d8415871b43cd7933e94d50fe85ac73c1aa3ecd2cf5efefd090ab4e231167477bad6

  • SSDEEP

    12288:THNZ/uVynsZdSFD9KbAt1jljuqOwBkw0f4lF3Z4mxxRwOwOagl0w7u:jS13u5KktGqOwewNlQmXa/n

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc7901e832ae98140638c31eca8c5642_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc7901e832ae98140638c31eca8c5642_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:3068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2092-0-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/2092-1-0x00000000003A0000-0x00000000003F4000-memory.dmp

      Filesize

      336KB

    • memory/2092-12-0x0000000003380000-0x0000000003383000-memory.dmp

      Filesize

      12KB

    • memory/2092-18-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2092-17-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/2092-16-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/2092-14-0x00000000033D0000-0x00000000033D1000-memory.dmp

      Filesize

      4KB

    • memory/2092-13-0x0000000003480000-0x0000000003481000-memory.dmp

      Filesize

      4KB

    • memory/2092-11-0x0000000003390000-0x0000000003391000-memory.dmp

      Filesize

      4KB

    • memory/2092-10-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

      Filesize

      4KB

    • memory/2092-9-0x0000000002430000-0x0000000002431000-memory.dmp

      Filesize

      4KB

    • memory/2092-8-0x0000000002010000-0x0000000002011000-memory.dmp

      Filesize

      4KB

    • memory/2092-7-0x0000000002020000-0x0000000002021000-memory.dmp

      Filesize

      4KB

    • memory/2092-6-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

      Filesize

      4KB

    • memory/2092-5-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

      Filesize

      4KB

    • memory/2092-4-0x0000000002030000-0x0000000002031000-memory.dmp

      Filesize

      4KB

    • memory/2092-3-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

      Filesize

      4KB

    • memory/2092-2-0x0000000002000000-0x0000000002001000-memory.dmp

      Filesize

      4KB

    • memory/2092-19-0x0000000000400000-0x000000000051D000-memory.dmp

      Filesize

      1.1MB

    • memory/2092-20-0x00000000003A0000-0x00000000003F4000-memory.dmp

      Filesize

      336KB