Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe
-
Size
276KB
-
MD5
c5d4e60867a41ed85c9657b0bc25d368
-
SHA1
91851694b4e180c32417d76c27eb1986fcc55e95
-
SHA256
2a3e86a39f5212bfc1d46a0a6d2e8c0ce57bb3ba5ba35695dbda1ea8d6790d27
-
SHA512
217956b841cf7c2a7d8976cd636dd6c75ba9621e0d4b37e1ccb8e0587daa2b6b3a797ae17d7bb0429233e5e3f2013e4a5d91b2f36ce27bc724c7bc4071b17bcf
-
SSDEEP
6144:2E/7pTSUCANVUyIcl8dEXQkEE80x5mJJJeNP:ZjotyBCqXQkEL0x5kJ
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 9 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/1688-4-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1688-5-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/1688-15-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2744-19-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2744-18-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1716-176-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1688-177-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1688-301-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1688-307-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2164 561C.tmp -
Loads dropped DLL 2 IoCs
pid Process 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\96D.exe = "C:\\Program Files (x86)\\LP\\BD14\\96D.exe" JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/1688-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1688-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1688-5-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1688-15-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2744-19-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2744-18-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1716-176-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1688-177-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1688-301-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1688-307-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\BD14\96D.exe JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe File opened for modification C:\Program Files (x86)\LP\BD14\96D.exe JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe File opened for modification C:\Program Files (x86)\LP\BD14\561C.tmp JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 561C.tmp -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 368 msiexec.exe Token: SeTakeOwnershipPrivilege 368 msiexec.exe Token: SeSecurityPrivilege 368 msiexec.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe Token: SeShutdownPrivilege 1540 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2744 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 32 PID 1688 wrote to memory of 2744 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 32 PID 1688 wrote to memory of 2744 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 32 PID 1688 wrote to memory of 2744 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 32 PID 1688 wrote to memory of 1716 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 34 PID 1688 wrote to memory of 1716 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 34 PID 1688 wrote to memory of 1716 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 34 PID 1688 wrote to memory of 1716 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 34 PID 1688 wrote to memory of 2164 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 37 PID 1688 wrote to memory of 2164 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 37 PID 1688 wrote to memory of 2164 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 37 PID 1688 wrote to memory of 2164 1688 JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe startC:\Users\Admin\AppData\Roaming\4967E\C0BBD.exe%C:\Users\Admin\AppData\Roaming\4967E2⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c5d4e60867a41ed85c9657b0bc25d368.exe startC:\Program Files (x86)\7E780\lvvm.exe%C:\Program Files (x86)\7E7802⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
C:\Program Files (x86)\LP\BD14\561C.tmp"C:\Program Files (x86)\LP\BD14\561C.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:368
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1540
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD569a819addbab20919b58a305735587fa
SHA12e0a844eed998e8e636e3fae4f8ee4a32f20636c
SHA256ee75c25274ea24593d0357da0530379674e53eeec2a0ee116d5f8bab21356fb8
SHA5127fbbd62626bf2b0b68acf7d35fa9a7b06c42e8895b02c0cdde334f5182a599f41730b74ba5c1616551be7135acfea08372edc168abad31c620ad995220252eb6
-
Filesize
600B
MD505df6cff899bbe2a79113124451d3924
SHA1d30ff0bd06c8a325a6e08efcbc270213b9d4bbde
SHA25684bfefd5ce82c323cb2d5ec5469c35d872b926936d4d89ebea15767c81c48034
SHA5123b28c19326739a71e2208fe3b7c827de8dcebf1703749b157528f31019f13f64de6c8b663225fd62eb900cbae643bac04ad9908d24e4c58534b38a687ac28f8e
-
Filesize
1KB
MD5e218fe75cd3eefc549f9ca5096bffa79
SHA1d3a477e66afd7b347fea372fe34a969ddcdafd7d
SHA25675248fb25392698323c5fbad175bf30c943a9f3bb3e98b4cba8ec918ed5c93ef
SHA512fdac945e5e0a53b6c019e198000e247dcff894b660ccf7b211ca1490741e29dd457a2a5cd84b0903fbff4c28b2c224c24fabccd8bc97c111f27b4d5a4f7fde19
-
Filesize
97KB
MD530ef35cf9813a455502542bec5b0bc02
SHA1a2fad2d6e63cbc8633fd6d9ed1d01dc2158a2098
SHA256e7f11fda294858419223584d1344d7e67bf9cb28033ed813507b7218fbd9b7cf
SHA512a9e0b810c93fb5145f7bfa6761048b3bede35a25cbddbd3c521d5e403022a51f83211b99835e065e2d4306a1467304d20dd54183440ded9a3dc1ce79c76f563f