Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe
-
Size
671KB
-
MD5
07bcaa4e24523921a744bd2b44a905c1
-
SHA1
d8ce3d7b73ed406dd267987fa982deaaf6e56669
-
SHA256
4bf6ab6739e121cc6754e4e1129029fa3c1f8bac32e78768d18fc4f36a033826
-
SHA512
ec29ea2477e9e8f6bfe69162018ce37df840f2dcbefbd1bf430efbd3e57b095cfca75f55d47dd579b5840dc20e87c9bc50f03fef7cc85d5447d552744fe730ff
-
SSDEEP
12288:kIPPHCI5zwJQ4+DZANEgwoir8eF3Z4mxxKcHxJ257n+fkbdKQOzi1Yq:kS0JQ4+QEOiRQmXxA5b+fkbEGF
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/files/0x0009000000023ba9-69.dat modiloader_stage2 behavioral2/memory/4916-73-0x0000000000400000-0x00000000004BD000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 4916 winload.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt winload.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winload.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4916 2636 JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe 83 PID 2636 wrote to memory of 4916 2636 JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe 83 PID 2636 wrote to memory of 4916 2636 JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe 83 PID 4916 wrote to memory of 412 4916 winload.exe 84 PID 4916 wrote to memory of 412 4916 winload.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07bcaa4e24523921a744bd2b44a905c1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\winload.exewinload.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:412
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
677KB
MD543582f752f41f5c335c59a1db922cb2c
SHA1504fc31ccb54e47af1275aebc1fb4ccb79f1fefc
SHA25691f2a147bdc17b4692128452614a0b33c2639b4a6421224e3d0ab44f23083011
SHA5127461e7ba2bf116d6f00754e704aad0240bfcea4602037db9b9cf493b57b6869d8f4121642b1c1f5baedd7a9e6e265692c365aedb6d7d7a449e65a0848d1eada7