Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 07:23
Behavioral task
behavioral1
Sample
JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe
-
Size
349KB
-
MD5
638103a9e0df16b472635ee8de8ef945
-
SHA1
418c9c86434ce0082308030187d89b5ac29e672c
-
SHA256
b864428cd9571ddfe0f19df545566c215fe8807ce30f6ca0ff0505b63e79daa2
-
SHA512
0100b5f634de52b6ccf356610984e65fbbc786727063efda12e8c55c184e066f4e763812fcb10a9ddce666aeec16d288ea7fd340b75a7399b61fab841c4d8ed8
-
SSDEEP
6144:OAMj7UGSaJxF+hzzyymJopApGSb9SMwm2tVV1d2QSJbAr:PMXmaJfemJopKNAVXd2QSJM
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral1/memory/2196-6-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/files/0x0007000000012116-12.dat modiloader_stage2 behavioral1/memory/1884-27-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/2464-40-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/2696-54-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/1684-63-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/2860-74-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/1764-83-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/2816-94-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/380-103-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 behavioral1/memory/1644-114-0x0000000000010000-0x000000000006D000-memory.dmp modiloader_stage2 -
Executes dropped EXE 20 IoCs
pid Process 1884 Keygen.exe 264 Keygen.exe 2464 Keygen.exe 2936 Keygen.exe 2696 Keygen.exe 2116 Keygen.exe 1684 Keygen.exe 3020 Keygen.exe 2860 Keygen.exe 2980 Keygen.exe 1764 Keygen.exe 2260 Keygen.exe 2816 Keygen.exe 448 Keygen.exe 380 Keygen.exe 2436 Keygen.exe 1644 Keygen.exe 2232 Keygen.exe 2456 Keygen.exe 536 Keygen.exe -
Loads dropped DLL 21 IoCs
pid Process 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 1884 Keygen.exe 264 Keygen.exe 264 Keygen.exe 2936 Keygen.exe 2936 Keygen.exe 2116 Keygen.exe 2116 Keygen.exe 3020 Keygen.exe 3020 Keygen.exe 2980 Keygen.exe 2980 Keygen.exe 2260 Keygen.exe 2260 Keygen.exe 448 Keygen.exe 448 Keygen.exe 2436 Keygen.exe 2436 Keygen.exe 2232 Keygen.exe 2232 Keygen.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Keygen.exe JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File opened for modification C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe File created C:\Windows\SysWOW64\Keygen.exe Keygen.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 2196 set thread context of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 1884 set thread context of 264 1884 Keygen.exe 32 PID 2464 set thread context of 2936 2464 Keygen.exe 35 PID 2696 set thread context of 2116 2696 Keygen.exe 37 PID 1684 set thread context of 3020 1684 Keygen.exe 39 PID 2860 set thread context of 2980 2860 Keygen.exe 41 PID 1764 set thread context of 2260 1764 Keygen.exe 43 PID 2816 set thread context of 448 2816 Keygen.exe 45 PID 380 set thread context of 2436 380 Keygen.exe 47 PID 1644 set thread context of 2232 1644 Keygen.exe 49 PID 2456 set thread context of 536 2456 Keygen.exe 51 -
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2196 wrote to memory of 2208 2196 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 30 PID 2208 wrote to memory of 1884 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 31 PID 2208 wrote to memory of 1884 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 31 PID 2208 wrote to memory of 1884 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 31 PID 2208 wrote to memory of 1884 2208 JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe 31 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 1884 wrote to memory of 264 1884 Keygen.exe 32 PID 264 wrote to memory of 2464 264 Keygen.exe 34 PID 264 wrote to memory of 2464 264 Keygen.exe 34 PID 264 wrote to memory of 2464 264 Keygen.exe 34 PID 264 wrote to memory of 2464 264 Keygen.exe 34 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2464 wrote to memory of 2936 2464 Keygen.exe 35 PID 2936 wrote to memory of 2696 2936 Keygen.exe 36 PID 2936 wrote to memory of 2696 2936 Keygen.exe 36 PID 2936 wrote to memory of 2696 2936 Keygen.exe 36 PID 2936 wrote to memory of 2696 2936 Keygen.exe 36 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2696 wrote to memory of 2116 2696 Keygen.exe 37 PID 2116 wrote to memory of 1684 2116 Keygen.exe 38 PID 2116 wrote to memory of 1684 2116 Keygen.exe 38 PID 2116 wrote to memory of 1684 2116 Keygen.exe 38 PID 2116 wrote to memory of 1684 2116 Keygen.exe 38 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 1684 wrote to memory of 3020 1684 Keygen.exe 39 PID 3020 wrote to memory of 2860 3020 Keygen.exe 40 PID 3020 wrote to memory of 2860 3020 Keygen.exe 40 PID 3020 wrote to memory of 2860 3020 Keygen.exe 40 PID 3020 wrote to memory of 2860 3020 Keygen.exe 40 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2860 wrote to memory of 2980 2860 Keygen.exe 41 PID 2980 wrote to memory of 1764 2980 Keygen.exe 42 PID 2980 wrote to memory of 1764 2980 Keygen.exe 42 PID 2980 wrote to memory of 1764 2980 Keygen.exe 42 PID 2980 wrote to memory of 1764 2980 Keygen.exe 42 PID 1764 wrote to memory of 2260 1764 Keygen.exe 43 PID 1764 wrote to memory of 2260 1764 Keygen.exe 43 PID 1764 wrote to memory of 2260 1764 Keygen.exe 43 PID 1764 wrote to memory of 2260 1764 Keygen.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 468 "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_638103a9e0df16b472635ee8de8ef945.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:448 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:380 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\system32\Keygen.exe 524 "C:\Windows\SysWOW64\Keygen.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\Keygen.exeC:\Windows\SysWOW64\Keygen.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD5638103a9e0df16b472635ee8de8ef945
SHA1418c9c86434ce0082308030187d89b5ac29e672c
SHA256b864428cd9571ddfe0f19df545566c215fe8807ce30f6ca0ff0505b63e79daa2
SHA5120100b5f634de52b6ccf356610984e65fbbc786727063efda12e8c55c184e066f4e763812fcb10a9ddce666aeec16d288ea7fd340b75a7399b61fab841c4d8ed8