Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
-
Size
165KB
-
MD5
cd0e91bba7713d1a7c66d50c4f9aed90
-
SHA1
fc4dde2537881ce341b8054fe64a9659a235bfaa
-
SHA256
31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095
-
SHA512
2a1eb564056bb3ea26d4ec36ba1c88482ec7fb26b788dbcde7389f654400403519d0d9c82ec544694e668ddbebba0b3a28ca4e70bf0e452764a6b5ada50615a5
-
SSDEEP
3072:EfkfcHxa/ZrtSBnZ+k2/d7V2g855t1dRTvydaDgA+XtZ4X:akfcHxaRhS7+kId/85zLRxgAiZ4
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe" cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1684-2-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2324-17-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2324-18-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/536-92-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2324 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 28 PID 1684 wrote to memory of 2324 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 28 PID 1684 wrote to memory of 2324 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 28 PID 1684 wrote to memory of 2324 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 28 PID 1684 wrote to memory of 536 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 30 PID 1684 wrote to memory of 536 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 30 PID 1684 wrote to memory of 536 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 30 PID 1684 wrote to memory of 536 1684 cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597B
MD5178fb5f6909ca4e576cddf3e16612df1
SHA164591df7ccb021fe012c68100968a4db95e4a374
SHA256dc40162ebef08c2e3ddd1694ae8e84304831d434bb0f62b261acba5fc39997df
SHA5124442b6f720c55be6b6b9308d1ee4a3ae91a8ca1a854882fdc21b0169b33228fb331b1dcae5bc10f4147d8f8ef41d2771ba30780b74e1368e942c4e281fa5d087
-
Filesize
1KB
MD55e010bcc94abd6e6006f7a86f9daef3d
SHA1e7703d42605b859233b4ce8e63d354484e209d9b
SHA256daf6917e27d91edc5267fcbb570486e2f19e1d97c73ca7e3fb953db49b7494c8
SHA512c2762e4fc47343c3996d105f62bad32ed9c185b5f9d5f623fc3dc188cae93a11b90f3e14dd32d2ec2c249df82892f61d4b8d0f9ee6b2ceaf1821202fabd42c27
-
Filesize
897B
MD51ab8821b6fbf6f824c533a3a24f70c51
SHA1452f8849da7e2085a55bdccbcc996362097a3342
SHA256f2b62a18a8f69d89bbdb28bf9503a5961679b70a4adcd070a321e33e1d76db77
SHA512ccfd1757cdb3ebc013423c58b54797108886cb69c76e51a12e724774b15bdab9b906ce4a7a82b5e23cf0b1889684b3f3039838b3a8e56703857f235ba7291c8f
-
Filesize
1KB
MD5c5d792b664812063ca4df6d226f53dc6
SHA15e583abfc5e77771c09dc4d273401646e7bd8d1b
SHA256ef7f6d3a51b7d29ca15ee2a0d93765996db1616bb92e5692fdcef6092d95a9f2
SHA512fa38eef8dbbbc6e275f5f7c12099370b65791020d9813698717fbebeb4bb2c1f5c3d9b9798438e32f5d6909536f361908e4ffe6f2fef549fa6c92b807883b232