Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe
-
Size
274KB
-
MD5
d8a51c2474cf026ae33090afc7784f0e
-
SHA1
05d69e34aea88a865b5aeea9e6986bce926cc671
-
SHA256
286daaed409467d0a4cf2e7160b2ad25a7745cbad7ec4122cef91ce5de7c96e8
-
SHA512
ee16487d8f0ead89804243f304d562378ac9e1e5a86ca10a4a03157fee181cf0094af2973383dae8ce45b8db20a16152bc9c8c62e27d7fab1b56a0a85ce52b87
-
SSDEEP
6144:8osAG8LcKh76KhgvPtnnrb9E5rw5DDcPpAsTPguGab7m2WzUff:b5Ggfh7BClnn39sUDDcRAEPYaGRzSf
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 8 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2340-13-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2340-15-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/1520-18-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1520-19-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2340-128-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2096-131-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2340-302-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2340-306-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1672 559F.tmp -
Loads dropped DLL 2 IoCs
pid Process 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A93.exe = "C:\\Program Files (x86)\\LP\\43F6\\A93.exe" JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2340-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2340-13-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1520-16-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2340-15-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1520-18-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1520-19-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2340-128-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2096-131-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2340-302-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2340-306-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\43F6\559F.tmp JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe File created C:\Program Files (x86)\LP\43F6\A93.exe JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe File opened for modification C:\Program Files (x86)\LP\43F6\A93.exe JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559F.tmp -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 544 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeSecurityPrivilege 2348 msiexec.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe Token: SeShutdownPrivilege 544 explorer.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1520 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 32 PID 2340 wrote to memory of 1520 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 32 PID 2340 wrote to memory of 1520 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 32 PID 2340 wrote to memory of 1520 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 32 PID 2340 wrote to memory of 2096 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 34 PID 2340 wrote to memory of 2096 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 34 PID 2340 wrote to memory of 2096 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 34 PID 2340 wrote to memory of 2096 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 34 PID 2340 wrote to memory of 1672 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 37 PID 2340 wrote to memory of 1672 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 37 PID 2340 wrote to memory of 1672 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 37 PID 2340 wrote to memory of 1672 2340 JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe startC:\Users\Admin\AppData\Roaming\6F5CE\CEF43.exe%C:\Users\Admin\AppData\Roaming\6F5CE2⤵
- System Location Discovery: System Language Discovery
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d8a51c2474cf026ae33090afc7784f0e.exe startC:\Program Files (x86)\CEB90\lvvm.exe%C:\Program Files (x86)\CEB902⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Program Files (x86)\LP\43F6\559F.tmp"C:\Program Files (x86)\LP\43F6\559F.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD50221d507d9d15885f7c0b79a5d7ae255
SHA1d15a35096d3edeb48a8c0845d1944909b0fcd201
SHA256f6cf21b004879d8c86a05f09cf04dcb3183489e70d6365cf5a0bcd208958a4a7
SHA512cabd1884366c2238719ec8b3ce1804d185480f7b3f3cfb19abb1b4af9aa0e913192b6de22e59c8e0b8a43df6db78d414c9bd1decd5eba40be5afdb1c0914f187
-
Filesize
600B
MD54cc2cad56faf1dedfdf6e4291c829bd6
SHA10697f301fd415ca50a70ca86fde9773826e4faec
SHA25664004549ea05a13dbf11c2d4ff7795941393bc495cd5c268d0aa178f9678c655
SHA512699a316304bf2ba6542fad9aa14a130d4f5930d83d1803a10fa7910a3c7d381b1b0fb9f2a1a02dcaf05d93cee4900a5725c0f46ccd87131332b64dcf4cb60f7c
-
Filesize
1KB
MD50445e101e9de5e9472b9da91737f6404
SHA178cfd2bc813c5658d208ca767370a213248e8b44
SHA2560e9552863ceb741be59feee0719b1e3db1e67580d1efb5f24d164ed9cb75b096
SHA5128b464dc7107d599a25bda34f107d51d73d7ffaf45bd4b1f077b94d96fac1fd4f209894384e83a7feeccac576e39a7866b398b13b0cf08bc0e7f544365b817756
-
Filesize
96KB
MD5133af0cf6ee94aff3802bb9ab41bcec1
SHA101fc1647ac02a199766ffde3a84c0ecb6c251163
SHA2565f544a9825ea73a90a389d6f1081aa550a9b2ab6fe4808473a189580ef984036
SHA512e6c78d712d22ed880b05da8a8f0c38cc7defb630823c7764b2887d64b778bc7a90a4dbd83731125cc3a7d30f5730e0f854fc246d9b7462e87d82e62e9314022e