Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/01/2025, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe
-
Size
279KB
-
MD5
9b70070f4fa4c61e59af39f8242c6f57
-
SHA1
00da630f90393c5d36d43f23d22c6f802b29feb9
-
SHA256
129dc8decdbb04d7d93a5e05c13b964339b36768cc5177dcecbaea6c88ebc9ea
-
SHA512
b11d697c71bc8a47b2e474adc1c37aae951c4e18bd5b9f6783e6d013d6fd9c0402e0c9a4e854bfcf975a8f5506eb249f1ae8461f89ccfb10619194ac2c697b9c
-
SSDEEP
6144:Rtf8AfuyPWgPX5p7jVvZYRjvi6vxOkcY400wXQOTytTP:XJtWgfPjVviRLio2U0EbTyp
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 8 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2944-11-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2944-14-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/2060-16-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2060-17-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2944-121-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2880-125-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2944-308-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot behavioral1/memory/2944-312-0x0000000000400000-0x000000000046B000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2304 6336.tmp -
Loads dropped DLL 2 IoCs
pid Process 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A92.exe = "C:\\Program Files (x86)\\LP\\3CD4\\A92.exe" JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2944-2-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2944-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2944-14-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2060-16-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2060-17-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2944-121-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2060-122-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2880-124-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2880-125-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2944-308-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2944-312-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\3CD4\A92.exe JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe File opened for modification C:\Program Files (x86)\LP\3CD4\6336.tmp JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe File created C:\Program Files (x86)\LP\3CD4\A92.exe JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6336.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 1712 msiexec.exe Token: SeTakeOwnershipPrivilege 1712 msiexec.exe Token: SeSecurityPrivilege 1712 msiexec.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe Token: SeShutdownPrivilege 2340 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe 2340 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2060 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 32 PID 2944 wrote to memory of 2060 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 32 PID 2944 wrote to memory of 2060 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 32 PID 2944 wrote to memory of 2060 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 32 PID 2944 wrote to memory of 2880 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 34 PID 2944 wrote to memory of 2880 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 34 PID 2944 wrote to memory of 2880 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 34 PID 2944 wrote to memory of 2880 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 34 PID 2944 wrote to memory of 2304 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 37 PID 2944 wrote to memory of 2304 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 37 PID 2944 wrote to memory of 2304 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 37 PID 2944 wrote to memory of 2304 2944 JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe startC:\Users\Admin\AppData\Roaming\473CB\8D33C.exe%C:\Users\Admin\AppData\Roaming\473CB2⤵
- System Location Discovery: System Language Discovery
PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b70070f4fa4c61e59af39f8242c6f57.exe startC:\Program Files (x86)\CB0A4\lvvm.exe%C:\Program Files (x86)\CB0A42⤵
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Program Files (x86)\LP\3CD4\6336.tmp"C:\Program Files (x86)\LP\3CD4\6336.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2340
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD53af732e7e5d9e5bf2dc2bcfbb069d997
SHA172e1f67bd2e82b65891ed60cca73728f0c873bea
SHA256e653ca445670a71525485f8a714ea2e70da7e62206093f515065d23f4e544064
SHA512917448e6515de40523e9f0ab33f02399733e7ac8e50a2f817f8243151db95adbae169b1cbb4b61c88cf4712e228200fac2ece5d62f2da1a77e0e248324548755
-
Filesize
600B
MD5d5fc7df46794939edbb3b12d71a63373
SHA102d991df10c08717312d4d3f6e9e4f96d78195ed
SHA2563f5a35eb6febf4b7889fd94509392dc6f0fe92bbe341d37a7aa58a32c726d5d5
SHA5121f926944d0c6b7efab93a6eabfa9c6cb19c4b9458f2b940c781707550c1427aed6b6fce7a9396c262e365bccf845f5c79d4702a94710f64bee5d4ece3ddd1fa2
-
Filesize
1KB
MD54f01eb7cdb22701b2b25f8e0389b671a
SHA1db66b325fa9246a1f3f85ee730d8c76d82c67385
SHA256eb1489c832f8b42468b4a93ffe18577e36ae88cc42a813a26478a3cd8a35e50c
SHA5129bca7c2daa00a282b188643f3388069fa05c69c195547b3409930e80c9b168da78d281e83666cdefe94d6e9cfab72e90f9acafb67ebca76dac6535a4573a6d27
-
Filesize
100KB
MD5bf889746b976483d428fb4fc511c9258
SHA18bd042e46dedd11c3a889561a12a5b49113c7008
SHA256e0ed94a14bf56d1457a2b61beac8e831baf80b1a272995abc6c1fd6b080e6e04
SHA5124047c2cb4661524635a705a4ec559fc75bd63b9afa86de760162f74df44a7d7f47b86a54769f8897510f050585e784c164e1d3ebd5b4b05b8f0de234557a61ff