Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe
-
Size
174KB
-
MD5
81d8d81c999cb15f2705ef51c8d3381f
-
SHA1
e8d2b638eef6932f97451cf08c64ceddf35ca9c2
-
SHA256
4d81f4e73f7694f509182f62b2635df8ef2e39d9e6a9bcb65c15b753ea62efcf
-
SHA512
2e151a6e48f33d455e4abe962a8fc94e2b84bdc09bbdf1cec3439133c7951dfa8f0c9bd8be73a0453f6484d1ca2cdeaf2ad1571768a64bea0135f2602d02875a
-
SSDEEP
3072:BHPaVdTJPkGxtyiGWvYIfbhdkPZjEgVFjChsILa1iFRYBeJw9uOcW2MtuJMIi:JPaVxxEiGWgkbhdwugqQaRY+JW5oZi
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 4 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2164-8-0x0000000000400000-0x0000000000463000-memory.dmp family_cycbot behavioral1/memory/2380-15-0x0000000000400000-0x0000000000463000-memory.dmp family_cycbot behavioral1/memory/2576-69-0x0000000000400000-0x0000000000463000-memory.dmp family_cycbot behavioral1/memory/2380-161-0x0000000000400000-0x0000000000463000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2380-2-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2164-5-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2164-6-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2164-8-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2380-15-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2576-69-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2380-161-0x0000000000400000-0x0000000000463000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2164 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 30 PID 2380 wrote to memory of 2164 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 30 PID 2380 wrote to memory of 2164 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 30 PID 2380 wrote to memory of 2164 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 30 PID 2380 wrote to memory of 2576 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 32 PID 2380 wrote to memory of 2576 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 32 PID 2380 wrote to memory of 2576 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 32 PID 2380 wrote to memory of 2576 2380 JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_81d8d81c999cb15f2705ef51c8d3381f.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD515d589eee306f5e5324b93f137f49fac
SHA15225623305fba836f32f1d4d3e26bdaae0745872
SHA256982a981a88bbf655c86f249fb0fe946ff0e0616c1735716b5ce3d00e91038418
SHA51286f4bab05dc8e8f893ee22c5a3d3983c6bceb4e543a903b5f1e92c53d518de4aa87a8909c0ef8bc9feef8836378a360974d36cbb446ab9b785bd7c753ad0fe56
-
Filesize
600B
MD5941af99e71d357bdc9a2aea5b8cbd519
SHA1d8382b66e96d4c9726505c42a7e381e60d0531a6
SHA256dfcb9b8fe569907cd133fc07ec6f372a5ec9241af45d7fe30d02f5d87342dc86
SHA512ecf6ba78c73edff991929f98d9eb71c68a82bbde2745553806790d9e84e93532756ff1da4c7c983d34000efea8504b28294ae93f341a7c26446aa16f5fdd3c8f
-
Filesize
996B
MD5624f15b18988d548de355101b29db910
SHA142bd8baff47c91836b27e880d9f1df523eb00a19
SHA25699bb555eb1bf260e2dde6f61248518a60b089a48985e3135eccec93a24f7b489
SHA5127f2d908b8ddd277efcf0b224e19ddab2469aac6327433563364d685b428b7f2ba0857c292bfa2e366803cc9d0bdd852f30cc4e97a25fdc16961a645417e10a80