Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe
-
Size
143KB
-
MD5
e4ffb95964e594d2d4d7fceaa73f5b51
-
SHA1
ba0a6b96b3a14b3fe2c204d94bbf8ba6f200f854
-
SHA256
6f84abca9dc49ce9b89555926023bbdddfa957e10b1c75d71406f4a4a9a5422a
-
SHA512
fa0884800739f79841507ae5cdb18dbd9ac54062a3d6dbf86b42ffea5588be651a111bbe3e0ac701148c29aa3c93c492f53fb5074cadca79ee580fd750ad000c
-
SSDEEP
3072:ENMDuFEI1ZCM1PqG9pT632FszuZMrBlurh/tY6PPuVd2lGfuncr2C:EOul2NGVn2+yunxC
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "userinit.exe,C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Modiloader family
-
ModiLoader Second Stage 8 IoCs
resource yara_rule behavioral1/memory/2724-10-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2724-11-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/2724-18-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/1224-31-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/1224-40-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/1224-39-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/1224-36-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 behavioral1/memory/1224-41-0x0000000030000000-0x0000000030035000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2808 apocalyps32.exe 1224 apocalyps32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\apocalyps32 = "C:\\Windows\\apocalyps32.exe" apocalyps32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1856 set thread context of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 2808 set thread context of 1224 2808 apocalyps32.exe 32 -
resource yara_rule behavioral1/memory/2724-3-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-8-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-10-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-11-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-9-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-7-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-4-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/2724-18-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-31-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-40-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-39-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-36-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-30-0x0000000030000000-0x0000000030035000-memory.dmp upx behavioral1/memory/1224-41-0x0000000030000000-0x0000000030035000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe File opened for modification C:\Windows\apocalyps32.exe JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe File opened for modification C:\Windows\apocalyps32.exe apocalyps32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1224 apocalyps32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 2808 apocalyps32.exe 1224 apocalyps32.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 1856 wrote to memory of 2724 1856 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 30 PID 2724 wrote to memory of 2808 2724 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 31 PID 2724 wrote to memory of 2808 2724 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 31 PID 2724 wrote to memory of 2808 2724 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 31 PID 2724 wrote to memory of 2808 2724 JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe 31 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 2808 wrote to memory of 1224 2808 apocalyps32.exe 32 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21 PID 1224 wrote to memory of 1252 1224 apocalyps32.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e4ffb95964e594d2d4d7fceaa73f5b51.exe
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\apocalyps32.exe-bs4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\apocalyps32.exe
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143KB
MD5e4ffb95964e594d2d4d7fceaa73f5b51
SHA1ba0a6b96b3a14b3fe2c204d94bbf8ba6f200f854
SHA2566f84abca9dc49ce9b89555926023bbdddfa957e10b1c75d71406f4a4a9a5422a
SHA512fa0884800739f79841507ae5cdb18dbd9ac54062a3d6dbf86b42ffea5588be651a111bbe3e0ac701148c29aa3c93c492f53fb5074cadca79ee580fd750ad000c