Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe
-
Size
278KB
-
MD5
f3a220cf311b8ab422c09c80723ee06b
-
SHA1
0f2c74d61edca1d477f91e2cda9d9d46cfcc1559
-
SHA256
16897b72c79bf3036212a4c2cf3b8b2cbb75620db0762e167cbab9d87f85e948
-
SHA512
2fc5b9b465752f1d52b3730167a873d3106896ef4273d7636457891a03f7e9a584cb37e1e2f07587a8fe88df1d64b4831bdfebed55163d5a8df5085222b20941
-
SSDEEP
6144:PWADCLvlryv64mSmW6yI6eOoq5UO1jQqRcm29I2oeVunDWAs:PVArS9mZ3X6VoOUOXZ29srDW
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 8 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2280-3-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2280-4-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/2280-13-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1680-18-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/952-118-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2280-119-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2280-197-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2280-203-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2516 AEA7.tmp -
Loads dropped DLL 2 IoCs
pid Process 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FE4.exe = "C:\\Program Files (x86)\\LP\\1C33\\FE4.exe" f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2280-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2280-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2280-4-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2280-13-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1680-16-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1680-18-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/952-118-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2280-119-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2280-197-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2280-203-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\1C33\FE4.exe f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\1C33\FE4.exe f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\LP\1C33\AEA7.tmp f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA7.tmp -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1624 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 2408 msiexec.exe Token: SeTakeOwnershipPrivilege 2408 msiexec.exe Token: SeSecurityPrivilege 2408 msiexec.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe Token: 33 2616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2616 AUDIODG.EXE Token: 33 2616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2616 AUDIODG.EXE Token: SeShutdownPrivilege 1624 explorer.exe Token: SeShutdownPrivilege 1624 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe 1624 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1680 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 30 PID 2280 wrote to memory of 1680 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 30 PID 2280 wrote to memory of 1680 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 30 PID 2280 wrote to memory of 1680 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 30 PID 2280 wrote to memory of 952 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 32 PID 2280 wrote to memory of 952 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 32 PID 2280 wrote to memory of 952 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 32 PID 2280 wrote to memory of 952 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 32 PID 2280 wrote to memory of 2516 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 36 PID 2280 wrote to memory of 2516 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 36 PID 2280 wrote to memory of 2516 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 36 PID 2280 wrote to memory of 2516 2280 f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\3585D\7451C.exe%C:\Users\Admin\AppData\Roaming\3585D2⤵
- System Location Discovery: System Language Discovery
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f3a220cf311b8ab422c09c80723ee06b_JaffaCakes118.exe startC:\Program Files (x86)\5DCAB\lvvm.exe%C:\Program Files (x86)\5DCAB2⤵
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Program Files (x86)\LP\1C33\AEA7.tmp"C:\Program Files (x86)\LP\1C33\AEA7.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1624
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD508a5937a576b475126ca81d436937a26
SHA10511a1e2596ab2ab23d032c2883c3380fdcc9878
SHA256e74db8ec9e61cb575458a11f2c8e750347a3f50f2e3a0153a7e191ef64923519
SHA512e1da5dbf78aef5ff60d6d6b3961cce297bb0bf96aa51d1f115be1c31110684ecac8585f69c4f1124d712b65b718da0374dc859884fb595d3a9835617bbde8a25
-
Filesize
600B
MD5468e52bbe38aa148c62c5ce6a284d21f
SHA15a80100f0ce1f4e7fc58e61dd13c32073d667983
SHA2568748f0a14011f61ae79fa867852c9709fec3e37264300aae4199d8ed24f7dde6
SHA512bdfde0e08f95dab0b2ca756bf8991c3ccd3ec43516178ae50dd81fc7cfde6bf477f719cd1966793876c4edc8c5645f85861d9b2255f37b734beac1d6a3afb0af
-
Filesize
996B
MD5dc62ba4f78b6918b8741e57f3fd89e0f
SHA1af40af0f0e654ac80188d115a3c36605ca47eafe
SHA256b33ac345c174589f2297b87079eea74371073a434f61cd65ec2a1006388353f7
SHA512a5531f5a843b15fba1d17b58abbcbafe905d82bb21fe7a3ecc6269872900510a741b1077cb67a1f74c2061973b6d27cf2729ffaa6b50b0a90a9cd61a9231b1c2