Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 03:12
Behavioral task
behavioral1
Sample
d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe
-
Size
71KB
-
MD5
d05fde111426608cfcbd1f0aa40c4d29
-
SHA1
76a71ceda5b47b754ca939ec19d52010a57f69fd
-
SHA256
02220218bc67d3093240078718f94f76cbbf01fbb484b812110ee3eb173ab38b
-
SHA512
22fa6588b2af68c02c070a82ef1227363270149ef5b534c55bc1dc85f11491acaf2e712a7bbb1f47d982ec1daa44cf3f02cec6313a21ff63c97728dde8299259
-
SSDEEP
1536:t9qSmMABU5i7fG3U9HA4p2d1WF+De/y99RR9+HRO+/p:TqSmMAffG3iHA4pI7D6y/ARO+/
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "userinit.exe,C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Modiloader family
-
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral1/memory/2336-8-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-19-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-21-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-24-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-26-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-29-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2828-31-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2828 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2336-6-0x0000000000560000-0x0000000000595000-memory.dmp upx behavioral1/files/0x000c0000000120d6-9.dat upx behavioral1/memory/2828-10-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2336-8-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-19-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-21-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-24-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-26-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-29-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2828-31-0x0000000030000000-0x0000000030035000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2828 apocalyps32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2828 apocalyps32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2828 2336 d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe 30 PID 2336 wrote to memory of 2828 2336 d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe 30 PID 2336 wrote to memory of 2828 2336 d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe 30 PID 2336 wrote to memory of 2828 2336 d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe 30 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21 PID 2828 wrote to memory of 1244 2828 apocalyps32.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d05fde111426608cfcbd1f0aa40c4d29_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\apocalyps32.exe-bs3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5d05fde111426608cfcbd1f0aa40c4d29
SHA176a71ceda5b47b754ca939ec19d52010a57f69fd
SHA25602220218bc67d3093240078718f94f76cbbf01fbb484b812110ee3eb173ab38b
SHA51222fa6588b2af68c02c070a82ef1227363270149ef5b534c55bc1dc85f11491acaf2e712a7bbb1f47d982ec1daa44cf3f02cec6313a21ff63c97728dde8299259