Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 20:35

General

  • Target

    e31d810d691a27e103cb7604ebdb84f1_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    e31d810d691a27e103cb7604ebdb84f1

  • SHA1

    6d41c655f44ce4bcfafd9ff97762dc293031244b

  • SHA256

    e7f0c18a58ef0420906486286839e291875072b344693a6b79364b0dc7bb4951

  • SHA512

    3c2d734d7b206eb5986c20fb8e5e33fe0b02660f7755fee6d1feabd4cbde75d60c2364c3b6c615770dbbd76e50b61256ec90e17f5087b00cb46fa0f0c1b98076

  • SSDEEP

    24576:vrILYJ7H8lakbW8jWsIFV1Llc9XOhrjGS51I4kJbARZv1cHG:TILC7H8l1/sZiXIrCSLIsZv1cHG

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1120
      • C:\Users\Admin\AppData\Local\Temp\e31d810d691a27e103cb7604ebdb84f1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e31d810d691a27e103cb7604ebdb84f1_JaffaCakes118.exe"
        2⤵
        • Identifies Wine through registry keys
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Users\Admin\AppData\Local\Temp\e31d810d691a27e103cb7604ebdb84f1_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\e31d810d691a27e103cb7604ebdb84f1_JaffaCakes118.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1120-29-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

      Filesize

      24KB

    • memory/1508-17-0x0000000020000000-0x0000000020175000-memory.dmp

      Filesize

      1.5MB

    • memory/1508-2-0x0000000000260000-0x0000000000261000-memory.dmp

      Filesize

      4KB

    • memory/1508-1-0x0000000001BE0000-0x0000000001D1A000-memory.dmp

      Filesize

      1.2MB

    • memory/1508-4-0x0000000001D20000-0x0000000001D21000-memory.dmp

      Filesize

      4KB

    • memory/1508-18-0x0000000020000000-0x0000000020175000-memory.dmp

      Filesize

      1.5MB

    • memory/1508-0-0x0000000020000000-0x0000000020175000-memory.dmp

      Filesize

      1.5MB

    • memory/1508-3-0x0000000020001000-0x0000000020003000-memory.dmp

      Filesize

      8KB

    • memory/2796-12-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2796-21-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2796-19-0x0000000020000000-0x0000000020175000-memory.dmp

      Filesize

      1.5MB

    • memory/2796-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2796-15-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2796-41-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB