Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    14s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 03:46

General

  • Target

    JaffaCakes118_01d76e7708bebba4c16c2f66a954c716.exe

  • Size

    447KB

  • MD5

    01d76e7708bebba4c16c2f66a954c716

  • SHA1

    4c8d3bfa410e14b1212d30b01eee2902fce7383a

  • SHA256

    31f835edf1a24203f2396bc3abcf0c2fb45db9a2e9c88c1ae55e76d962f73ed8

  • SHA512

    16f26d53eb115eb7eedb14aea131437f1115957f083b2228819b998a562d97489a6aad1728e4f6f2dd84d78159aad719b4abba491e4a2c2c67f25236dd1b30ab

  • SSDEEP

    12288:gJioa8VeO3ja3OsDRgCO1xxyy7x+MKLXUe:gYosOT6R81xxyyAVke

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01d76e7708bebba4c16c2f66a954c716.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_01d76e7708bebba4c16c2f66a954c716.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\222222~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\222222~1.EXE
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\222222~1.EXE

    Filesize

    404KB

    MD5

    194ad4989c128a810c77a7cab65eabf5

    SHA1

    99e0316a909c77de5f89ed4d36f61b1bf2e1266d

    SHA256

    677b252124020f5f0f403193d6d432a5a6531eb9e0aff0d8de91a072b04cd4a8

    SHA512

    438bdf92ce58894243a0654776695b6819ca3f0cdbf6c6c6b71bcf43196a1e39400b88d6814df20acc7d524e66439c4d7c537dff089d70d56c9b1fd1ea0169a0

  • memory/1272-8-0x00000000004C2000-0x00000000004C3000-memory.dmp

    Filesize

    4KB

  • memory/1272-9-0x0000000000400000-0x000000000052407C-memory.dmp

    Filesize

    1.1MB