Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
-
Size
182KB
-
MD5
d121faa3f6e90d545441cbc0340028d3
-
SHA1
0d23698099d257127c4ec31316375b1ecd6c4d8d
-
SHA256
e90c5722c7b1a0911acfbe99c939e855d44b57c732ac860a4411929895a74669
-
SHA512
2275665d9bf7e2a7e043d87c0099271d209dc0ec9e42fea650fd78e7693d368511815fb26b0496f7b19632dd1e011a766e4bf81fb63d4b4a16469f54d1067a54
-
SSDEEP
3072:U+A3w0NSJk5wD+hveJT7Mp2MDw9pI9R37IKIm7fgV5udVQ:b2wZJnChvC8p2MDwPICm7YV
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp family_cycbot behavioral1/memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp family_cycbot behavioral1/memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp family_cycbot behavioral1/memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp family_cycbot behavioral1/memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2468-1-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/1064-7-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral1/memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1064 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 30 PID 2468 wrote to memory of 1064 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 30 PID 2468 wrote to memory of 1064 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 30 PID 2468 wrote to memory of 1064 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 30 PID 2468 wrote to memory of 2448 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 32 PID 2468 wrote to memory of 2448 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 32 PID 2468 wrote to memory of 2448 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 32 PID 2468 wrote to memory of 2448 2468 d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5818ae28c022dc4c332a34d8ae10b5169
SHA19f10a2a0acffeffb142fdacb5a7762b4954ec03b
SHA2567a0035cb48124eb1807c11c65d2f16b714efcb863a21ef1f45e17d64630adc63
SHA512fda42e85f6343f36f2809d82bd135d0dbc3e7512e8a324f3aa4dbafe886659798963da29487e1db0c39e45905a3cc414c61b125083f9cba5ac629a5526a71aae
-
Filesize
600B
MD5601cfba884e1e7ce9c156429465bc143
SHA1f6b85d9628b73c0dc7a7bb81fd7c2d6cb5e2c9ad
SHA25600618c3aa73dddee84a125163e6366ae6077674a1ed13a67b13d2c5f40dd5692
SHA5126211f130965eca3903b676ef8b8230fd9930cce7a6f28add1dc9f09f648b2a075d818b35be9fd3280e675c2f9d0f9b198db2ba33aa1a86253d09aec9c017b95b
-
Filesize
996B
MD5f38c6cc0b1ad86f74fff92277ad24ee6
SHA1e1b4b01ad5be5cf719c1e5fc89c057bf1f09cca2
SHA256ede371403b483b3dc2000ceb1fa101642e02273b87355c13ccee52fa60b38074
SHA51240377d1ae5e8ae5b182ee4247a88f46fd2d27d4fe1e93548c939e082893734bae3e7d90abd799d2dd5cf1fa556d4a72a87b765404b079416c6ed65e47ff92725