Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2024, 06:40

General

  • Target

    fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe

  • Size

    260KB

  • MD5

    fed8809f59ea719559e7a9973ec8cde6

  • SHA1

    011f844fd04d077d73d1e93c61e8d6f579739e31

  • SHA256

    06403252e5932180b9e4322c4121755dca76ad60e49cf589c52ca784e59436b2

  • SHA512

    1d2fd038b5ac22c4b32cbe0ef36b2b3c750a38a7dd984621bea61c7638c902a04e70ac22949d3a80fd67b9aa61cb11ebaf9c87df74f2e1a898f4ead3484b894c

  • SSDEEP

    6144:Yjbei6AxsaKh5dkRwQS8wQF/2djq/RlI4AXE:Yua8rQhS8wQmj6lI4AXE

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 20 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MATCHL~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MATCHL~1.EXE
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Windows\mstwain32.exe
          "C:\Windows\mstwain32.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1108
          • C:\Windows\mstwain32.exe
            5⤵
            • UAC bypass
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1640
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe

    Filesize

    189KB

    MD5

    927a8ae82f9e319b99db376c6e93f87a

    SHA1

    ea724c7e4df1d9cc24aeb457fd9f8af58ad7ce67

    SHA256

    8d44c3e8b5baafcdabfba4bfdf57642ff4bddf61bf3b688941296fd6d0593ef5

    SHA512

    4199ae6743bea9231fe3342fbc87758037f620083642227c8fe919ea6ba2800fe9ddf06bc79e2dc5165031fe5993ba42e402e108900bb5d281e197fe41367a44

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2039016743-699959520-214465309-1000\699c4b9cdebca7aaea5193cae8a50098_d58f30ce-7498-4544-8c46-d67b11e386bc

    Filesize

    50B

    MD5

    5b63d4dd8c04c88c0e30e494ec6a609a

    SHA1

    884d5a8bdc25fe794dc22ef9518009dcf0069d09

    SHA256

    4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

    SHA512

    15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\MATCHL~1.EXE

    Filesize

    180KB

    MD5

    79f2764e509a4c703ba5f80dd9230bca

    SHA1

    873f84216169193bda8010530c188cfe2a5a7812

    SHA256

    43bc5d1db0e33b88f3e33ebf81ac2f7a2d28902dac79fb64f8e39cc5dc1f5e33

    SHA512

    1c7c78cf973529e82aee15ef12e123426223e7b1a16c042fa5a82bb9797925ad20dfc000e12f7f5008840c23da6612d84a8a52d8abd18cdf48f2a029a01aad82

  • memory/1108-58-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1108-77-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1108-64-0x0000000000280000-0x00000000002A2000-memory.dmp

    Filesize

    136KB

  • memory/1640-88-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-91-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-122-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-119-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-116-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-113-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-110-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-107-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-104-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-101-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-97-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-94-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-87-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-86-0x0000000002250000-0x000000000225E000-memory.dmp

    Filesize

    56KB

  • memory/1640-82-0x0000000002250000-0x000000000225E000-memory.dmp

    Filesize

    56KB

  • memory/1640-78-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-84-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-75-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-74-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-73-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1640-85-0x00000000004D0000-0x00000000004D8000-memory.dmp

    Filesize

    32KB

  • memory/2848-37-0x00000000003D0000-0x00000000003F2000-memory.dmp

    Filesize

    136KB

  • memory/2848-40-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/2876-22-0x00000000001A0000-0x00000000001C2000-memory.dmp

    Filesize

    136KB

  • memory/2876-16-0x00000000001A0000-0x00000000001C2000-memory.dmp

    Filesize

    136KB

  • memory/2984-34-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-57-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-38-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-53-0x0000000002EB0000-0x0000000002ED2000-memory.dmp

    Filesize

    136KB

  • memory/2984-45-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-44-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-43-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-31-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-28-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-30-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2984-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB