Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
71s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
-
Size
164KB
-
MD5
1eb92c6a918c7f5bdce6dfdafe6b8411
-
SHA1
2bda89cf5871ae9a62f7b3c575c1ae9dfb33fc59
-
SHA256
ade0e5801f4ff308ee39d0fbfdb34bf17805e793ed15cba7d316edea41867d82
-
SHA512
f3c4a87f9e12be454532de5da460b356b21e8a385ac6480976d05981c738bb40a862ed38e502d78d8175fa2f7fbba43c97c96f5984818537703354bb3056be0b
-
SSDEEP
3072:CWq4Z3ph6NvDRj11srQnrFM1lh9aQXPzsvJaoUvD2FjxXvJaRtKNh2v9SxzYdjN:CWq4xD6N7Rj1urorYPnssqLxajKD2v8e
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot behavioral1/memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe" JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe -
resource yara_rule behavioral1/memory/2608-2-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2168-6-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2168-5-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp upx behavioral1/memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2168 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 29 PID 2608 wrote to memory of 2168 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 29 PID 2608 wrote to memory of 2168 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 29 PID 2608 wrote to memory of 2168 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 29 PID 2608 wrote to memory of 1836 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 31 PID 2608 wrote to memory of 1836 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 31 PID 2608 wrote to memory of 1836 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 31 PID 2608 wrote to memory of 1836 2608 JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51531aad882c58a6bcc55d48e58d57226
SHA1aedaf6e07147240833f4ecc284844bd706f2ecf7
SHA256a559d1f90e6825ca5edbe6a1a5f4a890374ba9962f31076c25b6ae61a4e863be
SHA512801f96c34478de96a6a88274232c556fb22cc5efebcb9ecdf29f668f91eafa460733c9d4c3b698a689f8877cfe0a1d08914412ef839f14c7cdf2ee396ce91a27
-
Filesize
600B
MD51c10965ca79d61d3df384c3ec77a81b6
SHA1bf6f927090363613c7222d2eb52960560bf6d6cc
SHA256f40490d692463f0454ec26c8d34b50d5ebc1072cc2007442275a69cda2e9e622
SHA5122744b1f2ca7adb616c4b9887fcc33af8cdf5c0dd93a616bd870e6d649b6804b3d593fb3995122b8b806cae86cf28e0081fa929dda1c38d2b20e5fc2d79d83157
-
Filesize
996B
MD500dc00116fc0b3c6ee06c29583b4df67
SHA1e3db4794e58b7348e029232d797b376659fa76df
SHA2569ef805abbcb68d61b95c1b6f691ffe4afe30e94dda7a15361e1544ccb3f24ea0
SHA512438b87e5456aa11fb05bdc8d57f94c3695b5cbd4ab8e18108992a706f47c75fa33d666fe4453eb370b1574f88ffca523147c352b8b874747f771d2b6ece4b550