Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe
-
Size
284KB
-
MD5
685e776d56e2a2da4bb75e7534de0c39
-
SHA1
ba05cb5d2dbad8a1cdd35204016010ac1438f098
-
SHA256
7ea5999f1fa058cf8ec3b6a24de40236f528437856efaed2c5ede23525d34b8b
-
SHA512
af1324d25a9e38ea62c345018b26e3763cfdcc0bf9ad752fd20a55fdb037f57d0a83e5798eb2cf30600733fb03dc9fde7e51e35b5e54bdeab86b388f1c8efaa6
-
SSDEEP
6144:5b1Kdc1uv2zaTgbn94OlttKJ4jlBm08hQAZf7KciLsNsKxN0hKh8:Bto20gbnpD44jlg0L6BFxGK
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2472-11-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2472-13-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2316-16-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2472-78-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2580-80-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2472-200-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2472-203-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1040 FAF2.tmp -
Loads dropped DLL 2 IoCs
pid Process 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\E38.exe = "C:\\Program Files (x86)\\LP\\48BC\\E38.exe" JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2472-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2472-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2472-13-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2316-16-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2316-15-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2472-78-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2580-80-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2472-200-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2472-203-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\48BC\E38.exe JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe File opened for modification C:\Program Files (x86)\LP\48BC\E38.exe JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe File opened for modification C:\Program Files (x86)\LP\48BC\FAF2.tmp JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2016 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2732 msiexec.exe Token: SeTakeOwnershipPrivilege 2732 msiexec.exe Token: SeSecurityPrivilege 2732 msiexec.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2316 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 31 PID 2472 wrote to memory of 2316 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 31 PID 2472 wrote to memory of 2316 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 31 PID 2472 wrote to memory of 2316 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 31 PID 2472 wrote to memory of 2580 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 33 PID 2472 wrote to memory of 2580 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 33 PID 2472 wrote to memory of 2580 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 33 PID 2472 wrote to memory of 2580 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 33 PID 2472 wrote to memory of 1040 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 37 PID 2472 wrote to memory of 1040 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 37 PID 2472 wrote to memory of 1040 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 37 PID 2472 wrote to memory of 1040 2472 JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe startC:\Users\Admin\AppData\Roaming\CE23E\F5B48.exe%C:\Users\Admin\AppData\Roaming\CE23E2⤵
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_685e776d56e2a2da4bb75e7534de0c39.exe startC:\Program Files (x86)\3EBBD\lvvm.exe%C:\Program Files (x86)\3EBBD2⤵
- System Location Discovery: System Language Discovery
PID:2580
-
-
C:\Program Files (x86)\LP\48BC\FAF2.tmp"C:\Program Files (x86)\LP\48BC\FAF2.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2016
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54544b4c587cde404c1c5f7fa5d234926
SHA1dd51f015f7b381574cb2e0832fd1d42ecf4413e1
SHA2566f90e92dfa8d9da00e8d80a28ec773736b839c0a73b7f61c387ba60e7c48392c
SHA512f4affb86bc32a3086699c8e8f1314bd31246ed40307eaca4d920a78f37f58bec65e6b0e2b87c7449b4c2d9e64182d83b6f7692991e8da3be093bf492fc38f205
-
Filesize
600B
MD53a056c901d7d64bbd3eadfe770d0f83b
SHA1f54385105004ddfeb3c3f3b2aad5336763d9d7f3
SHA256aac9d0e8173efc847b9bc9adcdb4879c4e8c98b27f4b0a8e511ddad264b008a1
SHA512a0b6c0175e4851c2bd9c3615c14f8d674fe41ac3f6727c376cb258bb6499369e599a1a718cd38db974e7b8278d5c4b128f5f2748b0671d5c4271cbb6f9926c2d
-
Filesize
996B
MD566d3a752d05177501736f6d140f136f6
SHA1820e3e2f908ba0b274007830cbdfe961ca4b4b04
SHA256c217f3fc7299315c51c42d3f23ba562952414659b5d5ba5638cf5e7ea3f6ec30
SHA5126e51052afd41fc1314c635418318c0726747092dd30fb57928f763d4a0b72246d0b0bddce45fddba1ea5cba34f48fd77e4317f8c5fc6bd82befe118b9554f2a3
-
Filesize
100KB
MD57d9a7a08eaeb2f656e3f68ebf0154658
SHA1df305c4d5417ffbcfadf3a8345df3c8ebdcd2a21
SHA256ff8251a72bfe8c2cedb6385486e48a350ff03a8dc3bafec1296140c5e2f6e9aa
SHA512c22378d51662a1190766e696132465317c558264741d2aed44985774760b7bc793749ef7db4ffb3282488e2bc59263bf784035ec74a8077a7ae6f69fc62dfd93