Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe
-
Size
465KB
-
MD5
08a1e3adc6206524f6235e7e1b2c6d6c
-
SHA1
a1aed00b03bfaddeab1da87bcb31a98f3625efa4
-
SHA256
f60fa90d9233788b02de6739d3f69a5d0ffdb5cc1b492c1d73c2552b05d410e1
-
SHA512
2b3f03b96da4bfecb4b3f9f5dcf5919cc61d02a2dd9636149fd3c4da23529428e970ec8f40230a5d84bd219d1fb3ce017ef9e810dcad42f28fef314db83b7973
-
SSDEEP
12288:28TWmhxpOHQ87F3Z4mxxP7sIcOa/Y91TVK2E:YEHOQmXDsINwr2E
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral2/memory/1472-54-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-56-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-55-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-53-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-52-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-51-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-50-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-49-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-48-0x0000000003440000-0x0000000003468000-memory.dmp modiloader_stage2 behavioral2/memory/1472-82-0x0000000000400000-0x00000000004CE000-memory.dmp modiloader_stage2 behavioral2/memory/4012-84-0x0000000000C80000-0x0000000000CD4000-memory.dmp modiloader_stage2 -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netrt\Parameters\ServiceDll = "C:\\Windows\\System32\\sysn.dll" JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023ba7-79.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 4012 svchost.exe 4012 svchost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sysn.dll JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe File opened for modification C:\Windows\SysWOW64\sysn.dll JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe -
resource yara_rule behavioral2/memory/4012-80-0x0000000000C80000-0x0000000000CD4000-memory.dmp upx behavioral2/files/0x000a000000023ba7-79.dat upx behavioral2/memory/4012-84-0x0000000000C80000-0x0000000000CD4000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1472 wrote to memory of 324 1472 JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe 84 PID 1472 wrote to memory of 324 1472 JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe 84 PID 1472 wrote to memory of 324 1472 JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08a1e3adc6206524f6235e7e1b2c6d6c.exe"2⤵
- System Location Discovery: System Language Discovery
PID:324
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k network1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5c5fda079cfe10e3e22facd55841a9c23
SHA16c79e530e5cb70e51b446d57f000845939a4f666
SHA2563ee0715f16e3bec83efc602844cc2493db1f1c19a14f020757fa9d03fdaeaf21
SHA5124b679a1117d6f9c3b9c0a85fdf9797c5fd14438762fcf3ed2c1847a29c7508970794a9d6c3cc6141645788c7cd7316f4636bc0e61dc3e4bf80ff4274c5952613