Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe
-
Size
190KB
-
MD5
20fa8806d71bb47534851ad90d066a87
-
SHA1
e4b5adb63d2d2ba0eaa0ee01b38c711f69bc4698
-
SHA256
a7e6771ce3b4533578d3dbd33bd4ca06883ac83db2ac84d3fdd308d54ba1e20e
-
SHA512
fd14aca71dacd071a64552e7e37a75a10d301417ee6ad43a301fba06c3d8ebdc24d655ee3386f0650261b9f3f8c937bd10bd9705a56f946bbd7b675360dbf085
-
SSDEEP
3072:zds97MlKGzeEHJX7MTvQ6MDRmKuK7kJUV5Ed4DPHjHq0IzUlj/THWRWrQ3691QKv:+CRXpX7jv7eQ5Ed8HO0uUduW9LQKn/Eo
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 4 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/1864-6-0x0000000000400000-0x0000000000447000-memory.dmp family_cycbot behavioral1/memory/2532-13-0x0000000000400000-0x0000000000447000-memory.dmp family_cycbot behavioral1/memory/2236-75-0x0000000000400000-0x0000000000447000-memory.dmp family_cycbot behavioral1/memory/2532-169-0x0000000000400000-0x0000000000447000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2532-2-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/1864-5-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/1864-6-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/2532-13-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/2236-73-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/2236-75-0x0000000000400000-0x0000000000447000-memory.dmp upx behavioral1/memory/2532-169-0x0000000000400000-0x0000000000447000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1864 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 30 PID 2532 wrote to memory of 1864 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 30 PID 2532 wrote to memory of 1864 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 30 PID 2532 wrote to memory of 1864 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 30 PID 2532 wrote to memory of 2236 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 33 PID 2532 wrote to memory of 2236 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 33 PID 2532 wrote to memory of 2236 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 33 PID 2532 wrote to memory of 2236 2532 JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:1864
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_20fa8806d71bb47534851ad90d066a87.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5704ed3de39111ba423798ec414ac78b1
SHA18e4805abe460c8e0bbfc580a06ac921faea4ec39
SHA2565b4eaae06a9e2c9cb0144280d2aea79ac9dd59081b8a28bb113eddf630120fcc
SHA512c51fdc71f09eac268566644352385e8d2913e347200b5596b1104623216d6f0b1d8bd477edffd7f36a4e91d6c71ebc491b33982378dd58e9c8b98d48d236bb01
-
Filesize
600B
MD5a8e36aafe28eb7cbe0611e489f704a39
SHA14bbf386245f7e6cf171e5e888ca1cc0881b7b0df
SHA25655be753b2b370b806b45e627e6427aa8da1f27e73b1ae824e33e26523c500c4c
SHA512ed14dc9c5417a30a4922c2246c7c0ebb849d1057fc48cc6572d9f75f13a9dbdb42baa117f04ab2a64088a72028c9b0282762b9db23a77f3c99ce1b7cf6450c10
-
Filesize
996B
MD521d73e48ee722bbcf015e09c6f1bb85e
SHA1d47450bd962e5e98b345a955adf7140b0c9ea3dd
SHA25688de226291e200d3dd5ba2de5b7afe7dee39e531e438664a241b73ef92bf11fe
SHA512812c3b1796e9c89b9c34f75700e6170c41172784f1685cc6b1bf2c8be6100f4642b00df9c4887645e8225a9afc4a50fd91e374ad5513394a84e84abc735314da