Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/12/2024, 17:55
General
-
Target
e793e33cf97a0a04013f3f906c684aae_JaffaCakes118.exe
-
Size
967KB
-
MD5
e793e33cf97a0a04013f3f906c684aae
-
SHA1
2b2c2242402152586e0337f3cde3445ea5717d3a
-
SHA256
26c880377150c62f81d3bb30e26c78d2773cc314dd89b26fcdb666b168e99a1d
-
SHA512
439b51a51a511fb5c99db59c1d393671577434bc067960e396378f609b578c8f8f07fc47a94552edce7527e9aec0f401bc19ef98b58c135480f54fdf799106f0
-
SSDEEP
24576:7XqM+XKkCyE0W1bA74t1iKQXNX1UDrPboke+eWX:7aSEKQl0bc+X
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 17 IoCs
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 5 IoCs
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e793e33cf97a0a04013f3f906c684aae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e793e33cf97a0a04013f3f906c684aae_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\orçamento grafiato_2binderinvasor.exe"C:\Users\Admin\AppData\Local\Temp\orçamento grafiato_2binderinvasor.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD52f459567b556dd35811970ff40eb3708
SHA1048d85f8c02e70a2b6475f5c94a901124d6e7cc0
SHA2564811e7b1a46d1a8484907c6c1cbd48b022e0e9a3e0f4640e1d12db16ad69bac6
SHA5128922f5fde10f4618af36b4d95b20b2f269fa7d1127ffd2c954ab89c1185372efa8b25c566288c10faa26fe4557f6ef61565451030377b74fdb55f73292046d30
-
Filesize
114KB
MD5104d3f3881f9cda7b3ed2124349db1a6
SHA16300bf6d32ec138b238dfb37f58d8bc8b5da4ffa
SHA2565a44d260cf159783a1415591836ce9b38d07d96fdff39b4f1ded8a84c81e115d
SHA512cc3706b70ea8d243cb21eac40a45447dda7d38bb0ac0841e87ac81fb0921d138a1ce645c9cdffb9e46c55e927abbf818dfac500babd18a7d9755a4f3b6dc04eb
-
Filesize
33KB
MD5a6dcaf0601e13ee98ab5a3dce6b14d57
SHA168503a12b6805edd70233cad81da11c1b9f3d016
SHA256c588e3cb09118416fc8b6b9544fd45e12249a18c06b2160889b3aac27b1743db
SHA512edfc3a715abc25c38b42e00ba2f176ca65e31b29881f48f5b604edd1dfd2dca609c7d7a40f7fadc7deb984a07188d57d227100e19b085fb11cb5bbf21f13ea47
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
832KB
-
Filesize
8KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
324KB
-
Filesize
56KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
