Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 08:11

General

  • Target

    ddcf53ebfdbfc1b37fb764499874fb95_JaffaCakes118.exe

  • Size

    357KB

  • MD5

    ddcf53ebfdbfc1b37fb764499874fb95

  • SHA1

    09a354c1d0e4944788e067a81d713699289684de

  • SHA256

    1a137a5996a371f46ebb1876ad2f20e73a85a5ce71b3e18edf8682d4bedfeca5

  • SHA512

    18db3a75e1902371a8a0c8ce1817deba64cb5caa4a2e2ada526372485005dc4602629e81e1325967a7eeb446387001e5fb41e54db59df7053382a2ef00a29af4

  • SSDEEP

    6144:d/0uod9J+ztQbs9KFcaGEBY5NDXz/CZy1CjgZr2/qSx7HNYkvDHKpcMoCsVDob:dJ4J+ZQbscFcaRBY/jWy1CEMJYkslAVM

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddcf53ebfdbfc1b37fb764499874fb95_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ddcf53ebfdbfc1b37fb764499874fb95_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2009±¸~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2009±¸~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 544
        3⤵
        • Program crash
        PID:3088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2009±¸~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2009±¸~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 552
        3⤵
        • Program crash
        PID:5100
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1004 -ip 1004
    1⤵
      PID:3168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2840 -ip 2840
      1⤵
        PID:2428

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2009±¸~1.EXE

        Filesize

        692KB

        MD5

        1e5e154acac4b04cf135dda75b31f2e3

        SHA1

        89df0c9fdc40f3097c75f6e0cddbb16742fe9f17

        SHA256

        a952c17f2e55b474080c6fa246263cf25d06bd86e5d0623f705aa355df2a9f20

        SHA512

        4fc7c8bab79d01c3755e8566f32724891d9ce80e9876db0e638aa5c3ba96589a0e407c577d9e4d118c7de9a4ffdc22a9b0775dfb27a86cc6c14c6119249eab84

      • memory/1004-6-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

      • memory/1004-8-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

      • memory/3472-0-0x0000000001000000-0x000000000105C036-memory.dmp

        Filesize

        368KB

      • memory/3472-1-0x0000000001001000-0x0000000001002000-memory.dmp

        Filesize

        4KB

      • memory/3472-10-0x0000000001000000-0x000000000105C036-memory.dmp

        Filesize

        368KB