Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
-
Size
163KB
-
MD5
8c39ef4c2f9312349b98cf54f973c695
-
SHA1
f5a539f5f23b4e0de3d3d0a669d650d3c0906e53
-
SHA256
71dcd24da257c7bb0873fd9c276b7a463c9b85429589a338ae2e28787ae378c7
-
SHA512
31222a884abb443cc449bd03d0a4c4987e23cee7c4a909f724acd9103d5b0acf696a855574761872a8ffe910343912ff41019f0baabf09488417c7351d48f520
-
SSDEEP
3072:VE7bLMhkEUXRTAMszsW6tmfc67cW6troxFKjs5quCwuHT8dL7srl1WzlR9F3:VE7bLMCTAMsJjfP76B24A5q/HYdL7sJk
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 4 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2800-8-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2656-16-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2952-77-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2656-195-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2656-2-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2800-5-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2800-6-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2800-8-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2656-16-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2952-77-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2656-195-0x0000000000400000-0x0000000000468000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2800 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 30 PID 2656 wrote to memory of 2800 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 30 PID 2656 wrote to memory of 2800 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 30 PID 2656 wrote to memory of 2800 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 30 PID 2656 wrote to memory of 2952 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 32 PID 2656 wrote to memory of 2952 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 32 PID 2656 wrote to memory of 2952 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 32 PID 2656 wrote to memory of 2952 2656 JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD5467d983f6b6860b3404e79d0fead8623
SHA160ba36d35847ea6e7ffcedd048f2e653027c2f95
SHA256712940a2064305e644bfecdb12ca57fb51af47c66f2b99806fc2fa9280601a60
SHA512e4bc0087b14d6fe7d652af92552d0d47a7bd8a488087304d1c5128d58a1bd0eaf6500a087b4b902fda89f5f30d3020934fd53554aa101d6c4f0f7e146529a0f5
-
Filesize
1KB
MD5521c9f87aa1f4a96396ad5f5a5beb062
SHA1e2c0694b8e3c25c5dc53bb809eaa99abccba6a77
SHA2565d1ac155b2b7a28a64357384d6b4acec0fa8fdf449c76c04f55d4c3e8077ca0c
SHA512ca4f7f6e335cf5494de5f8cf9251b16db505deb5e94e37f2cd2fdda0c539ee04da5c58dfd9dcd3047b2f5d2f8337977dd154d7942e6f65dcbfb142e5c8261994
-
Filesize
600B
MD51aa366a44525dd64ad8c23bba8d91413
SHA139c2ec6469c678129a808d65559e4af49323bca3
SHA25678f7c6b7c13c68f0fd19cd69d1602cffb1ae63746329fbf4ad208716dcf82f26
SHA5127c4bcfee7c07a97d43f9e1d833eb84c713d2aaa69382c5a050eefe7d044277dde276e4a8096c3c8019149db4e19c8d66fe83c60ce8955ef2579fb3ebc6cd7bdb
-
Filesize
996B
MD5f59e1894d6094564ba69bade2aa2fb93
SHA1f641c3ac97b3fb6a6609a002c2e50973d55a3149
SHA2560d4450c68cc3259bf6f3346e7d0bd13fbac60d0f468ad9dd87c433ba88451072
SHA512bf821a2831386395b32d018d949102b3ecf2265224541b185b8434d7a26aa918872a3f9f22fa7ce6829f026f7811bc8e13d108e45eb8c3bfc0c3844004d1c1b3