Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 19:07
Behavioral task
behavioral1
Sample
JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe
-
Size
98KB
-
MD5
1628b9996843ef20f4f244df20aedf6a
-
SHA1
53752091fdac6c96fb501a497358fc78836e4289
-
SHA256
14ace75ccb680168d65193ea891b1ec7d377fe279a110966a8614cb8580b3c20
-
SHA512
6beb5ab3a303f1aba72d1e90280f711a71c7c4dbb5c0e7e3b12b00550ddbba6e253c1ebc07531ef137407e6143abb9bd421c662726f9437f6ae2593a21f037c2
-
SSDEEP
3072:73quPY2lphzkfNHBY9gSnYeSz2x97R3w+G0AhieHU+:Dw2lPofxOJYnz2x9y+FAhH
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/2548-7-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 behavioral1/memory/1740-10-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1740 apocalyps32.exe -
resource yara_rule behavioral1/memory/2548-0-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral1/files/0x0009000000012117-5.dat upx behavioral1/memory/2548-7-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral1/memory/1740-10-0x0000000000010000-0x0000000000036000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\apocalyps32.exe JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe File created C:\Windows\apocalyps32.exe JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1740 2548 JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe 30 PID 2548 wrote to memory of 1740 2548 JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe 30 PID 2548 wrote to memory of 1740 2548 JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe 30 PID 2548 wrote to memory of 1740 2548 JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe 30 PID 1740 wrote to memory of 3060 1740 apocalyps32.exe 31 PID 1740 wrote to memory of 3060 1740 apocalyps32.exe 31 PID 1740 wrote to memory of 3060 1740 apocalyps32.exe 31 PID 1740 wrote to memory of 3060 1740 apocalyps32.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1628b9996843ef20f4f244df20aedf6a.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\apocalyps32.exe-bs2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files\Internet Explorer\iexplore.exe-bs3⤵PID:3060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD51628b9996843ef20f4f244df20aedf6a
SHA153752091fdac6c96fb501a497358fc78836e4289
SHA25614ace75ccb680168d65193ea891b1ec7d377fe279a110966a8614cb8580b3c20
SHA5126beb5ab3a303f1aba72d1e90280f711a71c7c4dbb5c0e7e3b12b00550ddbba6e253c1ebc07531ef137407e6143abb9bd421c662726f9437f6ae2593a21f037c2