Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
-
Size
163KB
-
MD5
bd535bd28911efcc5f1236fa7903097d
-
SHA1
9ffa40211e2b84bfdb8f6b94eaa97f0fb0f4e454
-
SHA256
4cee0498c5648f19f40bccfb29fbd12adee24fb3a67551620cd8bb04ed53d298
-
SHA512
cc6197cd240e0dd983b4f400082e572d360e85132718f95ddec870c975d15934b3b83e6115e7473261ef78f56d120c690664204ca977f410302b61be59103c49
-
SSDEEP
3072:kisGEV8ThYW2AlDSRrZ9+iK3ATcBdwscGApAF3U66edfnBhWi:kim8Tll+lUMpAF3Z6eBBk
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/3056-5-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/3056-7-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/768-15-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/1412-81-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot behavioral1/memory/768-185-0x0000000000400000-0x0000000000468000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/768-2-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/3056-5-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/3056-7-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/768-15-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/1412-79-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/1412-81-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/768-185-0x0000000000400000-0x0000000000468000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 768 wrote to memory of 3056 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 30 PID 768 wrote to memory of 3056 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 30 PID 768 wrote to memory of 3056 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 30 PID 768 wrote to memory of 3056 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 30 PID 768 wrote to memory of 1412 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 33 PID 768 wrote to memory of 1412 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 33 PID 768 wrote to memory of 1412 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 33 PID 768 wrote to memory of 1412 768 JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:3056
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming2⤵
- System Location Discovery: System Language Discovery
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f56e872d0fb238eb6787c298a73be107
SHA13a388d3523fd9b88dd4de9e24bda1c59af4306ec
SHA2560274ad194a34e8bdf61b8017a0ab97f7089da6346fe4368f80afe4eb325cfd5e
SHA512508fd4ed34e098adb7f4369f457c1528cfc92d8c7f270e92bd04aacb1508a8a2cfa1171b579808d2830f909cef838b88cf6930efea21d5c5c5f178927ba43bc2
-
Filesize
600B
MD5f9196f1d16347e06ef10c65fd46a24e5
SHA109409b98fb022af53272f8723fec4d71097f122c
SHA2569b5d26adff5af7efb507f146995226396e52a5c276fb5026d812f3081f4677a9
SHA51254ceacae44a9c70bde04e9e0031ba82a88d2f96cddd937ee64152564b185aa3d442f1b02cbf13bb9cee41b38a20cd4224d64a3c0ef70351f200b405f7f0b8164
-
Filesize
996B
MD5f08603be3243d0b4047dc01c163329e3
SHA119ecfc5ea59534ceb5b9e7602a0a90c0880145dd
SHA25670ccea48436ee865c7d5e232d1586651c2dec3b86d7b8e165e66fb74bdabd6ab
SHA5120458d8448e7d07128791b20a4f86ff08643f8bcee567e66413d0690df3a8a7019602e5bab713fb5f7006ce28897d13f0794e40624fad963bc5c09f8ef6844358