Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 09:02

General

  • Target

    JaffaCakes118_0c2fbc0c25bc77a758969a5c748d5ff7.exe

  • Size

    264KB

  • MD5

    0c2fbc0c25bc77a758969a5c748d5ff7

  • SHA1

    be7707ba22645175690a8b9b5d2726877a058d70

  • SHA256

    bcce5a0c16a4f3df887b239f89ebbd15e1e9e1f7a89f2efc5957a6698ecfb9f3

  • SHA512

    2b81ac96cb06b6e15c8b318b108509da02d6314cc1bd04bc29b2968660a0188b8302f6919577b89ed1437545ef7e25ca2dd9ab1d8f240f2c2fad7c54c833e6f1

  • SSDEEP

    6144:Oj0T5W01GYl5xnjsJ6jV/phkfBAUOMC1/trwqNqyqtnH6aO4V:FT5X1f59s0jV/phEh+/tvNHQnHHV

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c2fbc0c25bc77a758969a5c748d5ff7.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c2fbc0c25bc77a758969a5c748d5ff7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0daa8a1476e4c903fddabc7160863470

    SHA1

    dfcd35689418b5a6a207cd130fd8e94f05726cd9

    SHA256

    8756b5c97319be53aa568a905e2da0d9fa7bc49574eff751ddf4a52eac07aff6

    SHA512

    b1bb56f508b32ffad27fe974633892bbc9c9ad186bf78822114964d294d5f7f76716b5cce093685f67f5a8990dd9a41e6fe868147d369eb3e2b84bd7b2bdc086

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1893eb66c3c4451381f53622c0ebe553

    SHA1

    ab532747e1ce4155778533797526f92948bf63c7

    SHA256

    aee2556b0c9e25bc44e74cf39cf618f7564e5e36ca0254ab44a8e095fc148600

    SHA512

    270ff4a3a523f3e06e33efe1308a43aa500eb0c8a434a5bbe22e46a231f4a1bb547098a4e2d14abd0dec7c1289d67de6fd39ecde1059a94e8b6f67d674185a3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9023f787c1d44dcf4fb27c03409abf6

    SHA1

    1ff03567333cd22feb7c909bfbc27d4e413d7c40

    SHA256

    10ab33fd8d9a15e8479b7f1a4da8ffe3f31f3e4d506e4acf984573e1e6cf8384

    SHA512

    3c2497057ef4332760e368fa8013a9c8ab179ce8c3ce2f281abb642af2f227c49b37984b579883e4838f62b11a552ca1d6e632fbeab170ee99abb1d827944387

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1477eaef4ca71d76c137f7b328e54737

    SHA1

    5de86d1fcee077d589ac1f52682fd791840228e5

    SHA256

    321d0da0b24ba499a6eab07a85f89c7b9d2d42b6d042e43e6d3071212345639c

    SHA512

    28fc19119d77de1b1c2f7c7895e7fa0505b59b6e6b0eff399884992eb7b24cbff40a805c7b0553d38928ead1913ab2ffc2d21fc962f381655122e58995a34e61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    146bf99007a88e28772f5709032ea3cc

    SHA1

    38af4b235f8543206c0c7e758238c337fc688c3b

    SHA256

    f7fa998b68345d421f4a375588cada4b16d833b921e2edc18d5fc23b3d7c61da

    SHA512

    1e4dbaa5c55bca9bfe30818291a6b65b6f1dab699377a5b9288b795272cfea145b533ffe1779a197008c9ef947d1c9794fda031b93c5c88d729a7aa221451468

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c2fa53e07255df008bc6a4f4419f871

    SHA1

    1db34b586dff7046983c251b0ccd3bf7c38c0864

    SHA256

    4d547420167400459cc7982c68da992d76a655d94891cf954fe2a2f3d1c7edb9

    SHA512

    889b9996b7939ef972beeb580803d9263ccb8babefa59a77a0dd935e602afb7aecc53d706e0d5decfaf7192c4711befd1e4bbc3e3456937501517d24ac109849

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1297d34b132a20dadbf0f8b29f1ca865

    SHA1

    0f5c0d2952bf763421406b08bc8dad84cc41ff85

    SHA256

    7871b4505e17709fc54baae9a9245ef2e3e394abeda816c1ed5a2131e3604b3a

    SHA512

    2b77a11718e95778b06b2d0f6c4762e569f453cb0668943a550b19053967b9d53fff4054ede7953cfab0026049e92c08e05539cdc3d95b202b12c9fc4e967518

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    549597671d64f8a3f23a24e88a5672a1

    SHA1

    d190f965d51060960f5a38a2b77d4567e9c23f7a

    SHA256

    0efc9f61e55abee39657c430706dc44b8c027e2f11551b9014e3776099d486e8

    SHA512

    b4b5efad8f7f14047318011c65fb0cd70c9b7dd631cb80b7b88ab53f007ed112948b8a0463f5cf715373333a787b62b2d914251f7a8ca8b008dcd562af45f1c5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b2a987162245b0964d2026edfd2de13

    SHA1

    df237f65a6a33071e577ecbc0848861e91452abc

    SHA256

    d498f005ea1dd4e8c8197a15820bd4b53d13cdaf070e389f2108a4dccd5d6840

    SHA512

    d496973776954c0214b72addbbeef424eb999068a168889a04b2f3da72aa6d1ff78d78fa267e16af8886495dedcdc6a507eda059781dd0fe023946bbb15e53d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d76e54667eedbbca84fb2251e3e08871

    SHA1

    ab557d534581e8483436588cf7f6f6728d3404e9

    SHA256

    82cb9ca0f211067b4652c8c26e81d57f7c1b98fcfef09e4a3d729306a39e95fe

    SHA512

    7af54d59a8a75e5a4ab86241784ff09fb23c712f38d489262243188f1de387ba694c2640d4b4bf5bdc745781c4b7293987fd50a22425edb7357e5feaabf40857

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3222df9f9a565a898b8a8969ce0a1948

    SHA1

    23a55ee40e63cc37bd5e2d3110ada7361bf6913f

    SHA256

    cb30c88c4cd4868021331210ee738779313d35fb82f0fba3fcc37346a46d576d

    SHA512

    45e04d459b119351f2786df4bfc5f3d5d0f0d5097acf578ad8ebc5d3003cc5a550a2f36953cc8f043683c13f4daa029592732c4e570b1b7f3d9d65037c4445ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    af1379b672e93a52497240a3e2861a2d

    SHA1

    0fb5d7298fb7c63e6e99388c1d56b89b6469a51d

    SHA256

    529285415334b485c4901e200658908f1af2dedb2c42b59876182928f4a78729

    SHA512

    954781ee9c7b0d1baf329a508f9e9434455e91e16ee895f09c5c327f44720453d30db2d87224a89639f83886f2809a22734ed7c0f94056dc2060bc5933ad4684

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dc21ae1314defe192829465048d488b3

    SHA1

    b12e667c61c6505924f74a3fdfe1d76fe646246c

    SHA256

    ce1871ddb155d32ac8c416aca83e20f8a641e519eaeb1b97dd7f1c505b58ab1c

    SHA512

    7bbd08cab3a0efb30a7675b7f4343cfef979f5c8077351687d7160e6a2c8131f7d62b07da672762192257b0a92ce87d775f18c02da04bbd195aa1a3754957773

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    141e465fbc0dc1fe16adeb9d4cd06436

    SHA1

    d438ccd26ef9dbd7d26ffbc417c95ccbad23ac93

    SHA256

    3e82973b811dbde1ce273bc83385741a753d10010d170fc4ef228bf29bbfbe43

    SHA512

    48a1e912377af96566f945aa041ccb23b202c2db9d256b8ea9220e7aba6b2775a567c667dd961bd62c622701bc12c40e75cb2b2e82b2829a8dcfbed2019888e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ec0895010ac128faecf9a72475c2fcdb

    SHA1

    d5c8cbfcae2be27d17c157bf1ecbebe4b90e263a

    SHA256

    f1f452e673bbe2b8bf9a7897319161ce75f156d14785fd3a8f0c471d15d2770a

    SHA512

    4ec4b7077b3204cb17a530e0b7b082b47f807489b350c8cef981c0fc4fd201d2736e77799f76b7c0d0fe6fedaee5a6cf7f13c8d510c08146fe1710268e094eaf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1ecf2b8450b8166ee044bcafdcc16db9

    SHA1

    f1d1369c953fb31639c582de0e7f5dad3f5326e4

    SHA256

    1dc6a5b4839ada4be461c910b0d5c14cc8549f4858fd4801bd8a5e7aa3827f18

    SHA512

    f83f284c9e70f4921947a5f723e34441ea318a1498750c824af51be53b9c78c84c71f938eba7a5fb3c7180e6d975a46bd60e63323be2b70943d00314e0c79cc6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66a1f54cfb560f1fa8b9b5351d5b0f2a

    SHA1

    69290466fe6e1ef0858c9d65b7cb23a7eddd2348

    SHA256

    1b7ee17703c49b49d654087d58adca33f41975cce0c902850c78f607c8677218

    SHA512

    dd5ed43025f43c6191b2937f416fe17a9aca5372041fae71067efcc70f8195d52155ea517ea5053d32d2646f302da9eb295809919bda7363218c61fcfcd61c46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    db1f02531e734dd929f7d3f771826738

    SHA1

    e72183b8f050ea266a8d9a8f70d4fe6329e2193e

    SHA256

    a1dc77f4d82cb4f22fe5632cafe353dddd46e079d93844f18a460dc380d162d3

    SHA512

    75b129315bc1859fadd2c8c36922340b38bf9b70971030d6424087e55fe3de7f43d11a580a342b2f6da65a63b185ac39a4f4964bd2b14038cc8eb1d649c05422

  • C:\Users\Admin\AppData\Local\Temp\Cab93DA.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar94A7.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2144-5-0x0000000000250000-0x000000000034F000-memory.dmp

    Filesize

    1020KB

  • memory/2604-0-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/2604-1-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2604-2-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB

  • memory/2604-3-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2604-6-0x0000000000400000-0x00000000004FF000-memory.dmp

    Filesize

    1020KB