Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 00:12

General

  • Target

    JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe

  • Size

    465KB

  • MD5

    08a1e3adc6206524f6235e7e1b2c6d6c

  • SHA1

    a1aed00b03bfaddeab1da87bcb31a98f3625efa4

  • SHA256

    f60fa90d9233788b02de6739d3f69a5d0ffdb5cc1b492c1d73c2552b05d410e1

  • SHA512

    2b3f03b96da4bfecb4b3f9f5dcf5919cc61d02a2dd9636149fd3c4da23529428e970ec8f40230a5d84bd219d1fb3ce017ef9e810dcad42f28fef314db83b7973

  • SSDEEP

    12288:28TWmhxpOHQ87F3Z4mxxP7sIcOa/Y91TVK2E:YEHOQmXDsINwr2E

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 11 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:324
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k network
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\sysn.dll

    Filesize

    123KB

    MD5

    c5fda079cfe10e3e22facd55841a9c23

    SHA1

    6c79e530e5cb70e51b446d57f000845939a4f666

    SHA256

    3ee0715f16e3bec83efc602844cc2493db1f1c19a14f020757fa9d03fdaeaf21

    SHA512

    4b679a1117d6f9c3b9c0a85fdf9797c5fd14438762fcf3ed2c1847a29c7508970794a9d6c3cc6141645788c7cd7316f4636bc0e61dc3e4bf80ff4274c5952613

  • memory/1472-0-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB

  • memory/1472-1-0x0000000000AC0000-0x0000000000B14000-memory.dmp

    Filesize

    336KB

  • memory/1472-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/1472-54-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-56-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-55-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-53-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-52-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-51-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-50-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-49-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-48-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-47-0x0000000003440000-0x0000000003468000-memory.dmp

    Filesize

    160KB

  • memory/1472-46-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-45-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-44-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-43-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-42-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-41-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-40-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-39-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-38-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-37-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-36-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-35-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-34-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-33-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-32-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-31-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-30-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-29-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-28-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-27-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-26-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-25-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-24-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-23-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-22-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-21-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-20-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-19-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-18-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-17-0x0000000003440000-0x0000000003441000-memory.dmp

    Filesize

    4KB

  • memory/1472-16-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-15-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-14-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-13-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-12-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-11-0x0000000003450000-0x0000000003451000-memory.dmp

    Filesize

    4KB

  • memory/1472-10-0x0000000002470000-0x0000000002471000-memory.dmp

    Filesize

    4KB

  • memory/1472-9-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1472-8-0x00000000024B0000-0x00000000024B1000-memory.dmp

    Filesize

    4KB

  • memory/1472-6-0x0000000002450000-0x0000000002451000-memory.dmp

    Filesize

    4KB

  • memory/1472-5-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/1472-4-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/1472-3-0x0000000002480000-0x0000000002481000-memory.dmp

    Filesize

    4KB

  • memory/1472-2-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

  • memory/1472-76-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/1472-75-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-74-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-73-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-72-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-71-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-70-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-69-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-68-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-67-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-66-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-65-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-64-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-63-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-62-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-61-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-60-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-59-0x0000000003440000-0x0000000003480000-memory.dmp

    Filesize

    256KB

  • memory/1472-83-0x0000000000AC0000-0x0000000000B14000-memory.dmp

    Filesize

    336KB

  • memory/1472-82-0x0000000000400000-0x00000000004CE000-memory.dmp

    Filesize

    824KB

  • memory/4012-80-0x0000000000C80000-0x0000000000CD4000-memory.dmp

    Filesize

    336KB

  • memory/4012-84-0x0000000000C80000-0x0000000000CD4000-memory.dmp

    Filesize

    336KB