Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe
-
Size
260KB
-
MD5
fed8809f59ea719559e7a9973ec8cde6
-
SHA1
011f844fd04d077d73d1e93c61e8d6f579739e31
-
SHA256
06403252e5932180b9e4322c4121755dca76ad60e49cf589c52ca784e59436b2
-
SHA512
1d2fd038b5ac22c4b32cbe0ef36b2b3c750a38a7dd984621bea61c7638c902a04e70ac22949d3a80fd67b9aa61cb11ebaf9c87df74f2e1a898f4ead3484b894c
-
SSDEEP
6144:Yjbei6AxsaKh5dkRwQS8wQF/2djq/RlI4AXE:Yua8rQhS8wQmj6lI4AXE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 20 IoCs
resource yara_rule behavioral1/memory/2984-44-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2984-45-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2984-57-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-75-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-88-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-91-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-94-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-97-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-101-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-104-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-107-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-110-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-113-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-116-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-119-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1640-122-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 5 IoCs
pid Process 2492 MATCHL~1.EXE 2848 jihad123.exe 2984 jihad123.exe 1108 mstwain32.exe 1640 mstwain32.exe -
Loads dropped DLL 5 IoCs
pid Process 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 2848 jihad123.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jihad123.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2848 set thread context of 2984 2848 jihad123.exe 32 PID 1108 set thread context of 1640 1108 mstwain32.exe 37 -
resource yara_rule behavioral1/memory/2984-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-34-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-30-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-43-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-45-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2984-57-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-75-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-73-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-87-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-88-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-91-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-94-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-97-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-101-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-104-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-107-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-110-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-113-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-116-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-119-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1640-122-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe jihad123.exe File opened for modification C:\Windows\mstwain32.exe jihad123.exe File opened for modification C:\Windows\mstwain32.exe mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MATCHL~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jihad123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jihad123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2984 jihad123.exe Token: SeBackupPrivilege 2360 vssvc.exe Token: SeRestorePrivilege 2360 vssvc.exe Token: SeAuditPrivilege 2360 vssvc.exe Token: SeDebugPrivilege 1640 mstwain32.exe Token: SeDebugPrivilege 1640 mstwain32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 MATCHL~1.EXE 2492 MATCHL~1.EXE 2848 jihad123.exe 1108 mstwain32.exe 1640 mstwain32.exe 1640 mstwain32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2492 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2492 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2492 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2492 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 30 PID 2876 wrote to memory of 2848 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 31 PID 2876 wrote to memory of 2848 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 31 PID 2876 wrote to memory of 2848 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 31 PID 2876 wrote to memory of 2848 2876 fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe 31 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2848 wrote to memory of 2984 2848 jihad123.exe 32 PID 2984 wrote to memory of 1108 2984 jihad123.exe 36 PID 2984 wrote to memory of 1108 2984 jihad123.exe 36 PID 2984 wrote to memory of 1108 2984 jihad123.exe 36 PID 2984 wrote to memory of 1108 2984 jihad123.exe 36 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 PID 1108 wrote to memory of 1640 1108 mstwain32.exe 37 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fed8809f59ea719559e7a9973ec8cde6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MATCHL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MATCHL~1.EXE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jihad123.exe
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\mstwain32.exe
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1640
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2360
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD5927a8ae82f9e319b99db376c6e93f87a
SHA1ea724c7e4df1d9cc24aeb457fd9f8af58ad7ce67
SHA2568d44c3e8b5baafcdabfba4bfdf57642ff4bddf61bf3b688941296fd6d0593ef5
SHA5124199ae6743bea9231fe3342fbc87758037f620083642227c8fe919ea6ba2800fe9ddf06bc79e2dc5165031fe5993ba42e402e108900bb5d281e197fe41367a44
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2039016743-699959520-214465309-1000\699c4b9cdebca7aaea5193cae8a50098_d58f30ce-7498-4544-8c46-d67b11e386bc
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
180KB
MD579f2764e509a4c703ba5f80dd9230bca
SHA1873f84216169193bda8010530c188cfe2a5a7812
SHA25643bc5d1db0e33b88f3e33ebf81ac2f7a2d28902dac79fb64f8e39cc5dc1f5e33
SHA5121c7c78cf973529e82aee15ef12e123426223e7b1a16c042fa5a82bb9797925ad20dfc000e12f7f5008840c23da6612d84a8a52d8abd18cdf48f2a029a01aad82