Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe
-
Size
264KB
-
MD5
ddc1fb6f34f31af70cb5fc800b456c13
-
SHA1
bbb258fcb2d8b38857b5231d1e0ebc36dd22ea47
-
SHA256
2161bd42c12aae9b2847654c847150d613764aaac456b91377b6491750ad1afa
-
SHA512
1877d94158eedb5809701339814b997fa82f20d56c0cba644f0fb18daabce3068fe2f6548df50af41e097078145cccd15a82c10730d210df455777a461279a14
-
SSDEEP
6144:2Q8QlsQvnVwnMT1q2WUBts4GQAu1Ag735+nn60ZQE9Ti:OQlsinVwMTI0vs4Nmg1KZQ8T
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = ",C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Modiloader family
-
ModiLoader Second Stage 6 IoCs
resource yara_rule behavioral2/memory/2228-33-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral2/memory/2228-32-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral2/memory/2228-37-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral2/memory/3812-44-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral2/memory/3812-46-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral2/memory/3812-45-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 904 dZ CSS VIP.exe 1532 j3rhaO9w.exe 2228 j3rhaO9w.exe 1508 apocalyps32.exe 3812 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1532 set thread context of 2228 1532 j3rhaO9w.exe 84 PID 1508 set thread context of 3812 1508 apocalyps32.exe 86 -
resource yara_rule behavioral2/memory/2228-28-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/2228-30-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/2228-31-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/2228-33-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/2228-32-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/2228-37-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/3812-44-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/3812-43-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/3812-46-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral2/memory/3812-45-0x0000000030000000-0x0000000030035000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe j3rhaO9w.exe File opened for modification C:\Windows\apocalyps32.exe j3rhaO9w.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dZ CSS VIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language j3rhaO9w.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language j3rhaO9w.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3812 apocalyps32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 904 dZ CSS VIP.exe 1532 j3rhaO9w.exe 1508 apocalyps32.exe 3812 apocalyps32.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4824 wrote to memory of 904 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 82 PID 4824 wrote to memory of 904 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 82 PID 4824 wrote to memory of 904 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 82 PID 4824 wrote to memory of 1532 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 83 PID 4824 wrote to memory of 1532 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 83 PID 4824 wrote to memory of 1532 4824 ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe 83 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 1532 wrote to memory of 2228 1532 j3rhaO9w.exe 84 PID 2228 wrote to memory of 1508 2228 j3rhaO9w.exe 85 PID 2228 wrote to memory of 1508 2228 j3rhaO9w.exe 85 PID 2228 wrote to memory of 1508 2228 j3rhaO9w.exe 85 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 1508 wrote to memory of 3812 1508 apocalyps32.exe 86 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55 PID 3812 wrote to memory of 3408 3812 apocalyps32.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\dZ CSS VIP.exe"C:\Users\Admin\AppData\Local\Temp\dZ CSS VIP.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\j3rhaO9w.exe"C:\Users\Admin\AppData\Local\Temp\j3rhaO9w.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\j3rhaO9w.exe"C:\Users\Admin\AppData\Local\Temp\j3rhaO9w.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\apocalyps32.exe-bs5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\apocalyps32.exe"C:\Windows\apocalyps32.exe"6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c1353577d1e0bd98fbc3df09d9414f9e
SHA1a6c46bf84b99fa638e6663dc7bdf3a6f5c1e8ebc
SHA256a21abebd6fb5e31fb0ce325d6497c78bf0faf604f04c71c66fdea5979b7edadd
SHA512545f86909db4d83f12bbe08ae204a7f2ca22ae284f0201be34e77fca5a38ae6edd53bd222dde6b70351c5882b7f6dce3a1c2a031f3bc4e6759ec1a42216f35c9
-
Filesize
160KB
MD55fcb308a97a71b94678b1d4e06fe2fca
SHA1caa0782bb8b9f6c34cb67036b5174379df3fd36b
SHA25667a1e3353641bed3c1dcd21f85eaba43e99efda392bcdbf88b7b1cd8bc8ffcbb
SHA5124e728c296b61436e47d9c2dfc1793c3323a70ef3a895fc12903880b0e9f48225ddc035d0230f574c41bbaaaba03b1ccd80d1064a5abba40b9c3f8c8100ab9571