Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe
-
Size
279KB
-
MD5
7bdc725fae9375ad4e9e6b1232c37b59
-
SHA1
3692d14ccc2a30ccd87cf8ec3e30137a0b38b8fc
-
SHA256
7d563c89c09999a6d5ece4c74e5729e7283a1d1a76e1d78e11c857f4b7ec2b9a
-
SHA512
5e4ad98388ee3986016526e7a51f091975268d4278822548da07475e343233de25c34b624f130492b6cafa522217dfbb373f16e9a326caac35d699e242e88a98
-
SSDEEP
6144:vnOp4Xhk1OJ6IWJrQOfss+OsVSPD7RMZ1BCgryz0:NXha+62V2s8mZ2yyz0
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 9 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2148-3-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2148-4-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2148-13-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2560-17-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2560-18-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2264-108-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2148-109-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2148-199-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2148-205-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1900 F824.tmp -
Loads dropped DLL 2 IoCs
pid Process 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\166.exe = "C:\\Program Files (x86)\\LP\\7D6B\\166.exe" JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2148-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2148-3-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2148-4-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2148-13-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2560-17-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2560-18-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2264-108-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2148-109-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2148-199-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2148-205-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\7D6B\F824.tmp JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe File created C:\Program Files (x86)\LP\7D6B\166.exe JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe File opened for modification C:\Program Files (x86)\LP\7D6B\166.exe JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 2480 msiexec.exe Token: SeTakeOwnershipPrivilege 2480 msiexec.exe Token: SeSecurityPrivilege 2480 msiexec.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe Token: 33 1424 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1424 AUDIODG.EXE Token: 33 1424 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1424 AUDIODG.EXE Token: SeShutdownPrivilege 2492 explorer.exe Token: SeShutdownPrivilege 2492 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe 2492 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2560 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 30 PID 2148 wrote to memory of 2560 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 30 PID 2148 wrote to memory of 2560 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 30 PID 2148 wrote to memory of 2560 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 30 PID 2148 wrote to memory of 2264 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 32 PID 2148 wrote to memory of 2264 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 32 PID 2148 wrote to memory of 2264 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 32 PID 2148 wrote to memory of 2264 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 32 PID 2148 wrote to memory of 1900 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 36 PID 2148 wrote to memory of 1900 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 36 PID 2148 wrote to memory of 1900 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 36 PID 2148 wrote to memory of 1900 2148 JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe startC:\Users\Admin\AppData\Roaming\B90A6\7997D.exe%C:\Users\Admin\AppData\Roaming\B90A62⤵
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bdc725fae9375ad4e9e6b1232c37b59.exe startC:\Program Files (x86)\A6B96\lvvm.exe%C:\Program Files (x86)\A6B962⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Program Files (x86)\LP\7D6B\F824.tmp"C:\Program Files (x86)\LP\7D6B\F824.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2492
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5541⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD557a1766d20a12fc87d328a961a92e00e
SHA1e339678067c77ae402be364148d197471e013c78
SHA256238d38962e6a35421740a176fe1ebb8f510cb55a70aee5b8b69eff2733553679
SHA512a6c483b64bde2c53be6f2a09e03fb4a3f0ca5e16e7dae5fa84aca56a2785d95b2aff1d7583fcdd76da0417e8a8d6d6d51678d2f9c603858fa6dfde61e9d5de36
-
Filesize
996B
MD518b4650e4794c7187871f3bf2dd472c5
SHA1bb9e1ee57a5830d7abcf6e4aa505249ac72cbab0
SHA2568ee67da4ac512b2c63d20a37e29692f4a0616d76fd56f73c9f7e7f6c428fdb66
SHA51270932e2edf8debbcf4b913bf498151c104a35c4e79e3e4bb63212eb85b59255095df64b5dd5f53e90cfecc70414c75f57f5ce795f8c453e84f4a608d3afc7d95
-
Filesize
100KB
MD5712b790234a6b80a3dc179d07b4c631d
SHA1a64060d004591899343721e4e10a62805b848954
SHA256344dd99a3ae192c9f7d5fbaa1774ea1346aa1f7a71b86e06362cb7cc75184d81
SHA512847c3a679622bad14e57e3c093f3396282fb68883caaadc51f28ab54f49b0b233d5f3d2e852f87f17b8bbca8fed43378a8c03ab97f1c095defa9ade3b9b40cb8