Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
-
Size
286KB
-
MD5
f12b041a97635889b604ba50c0bd74ba
-
SHA1
50bba2a078e5e0532ac4a6b9afb65939e51f36aa
-
SHA256
14471b11af9c7e955fe25f0f78d160641b54dcc0b44308122126301ababb529c
-
SHA512
c699de93883ff00c89d34b431fcc33313f6c41036ba47f735d955a220785eb84190e3c1afd3874bfd11e66682e698beb82461fb741d6949b923c67e029c58d1c
-
SSDEEP
6144:uaZSa/cYxwoM93zRWqHIqYHRx4EC8EKMCX7d1RqBQv:uva/zDMqHL4Pwd14
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/1980-48-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot behavioral1/memory/1980-51-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral1/memory/1412-53-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot behavioral1/memory/1980-169-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot behavioral1/memory/3060-173-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot behavioral1/memory/1980-344-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot behavioral1/memory/1980-348-0x0000000000400000-0x000000000046C000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1000 650A.tmp -
Loads dropped DLL 2 IoCs
pid Process 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5C1.exe = "C:\\Program Files (x86)\\LP\\B3E4\\5C1.exe" JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/1980-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1980-48-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1412-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1980-51-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1412-53-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1980-169-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3060-171-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3060-173-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1980-344-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1980-348-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\B3E4\650A.tmp JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe File created C:\Program Files (x86)\LP\B3E4\5C1.exe JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe File opened for modification C:\Program Files (x86)\LP\B3E4\5C1.exe JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 650A.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 876 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2480 msiexec.exe Token: SeTakeOwnershipPrivilege 2480 msiexec.exe Token: SeSecurityPrivilege 2480 msiexec.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe Token: SeShutdownPrivilege 876 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe 876 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1412 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 32 PID 1980 wrote to memory of 1412 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 32 PID 1980 wrote to memory of 1412 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 32 PID 1980 wrote to memory of 1412 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 32 PID 1980 wrote to memory of 3060 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 34 PID 1980 wrote to memory of 3060 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 34 PID 1980 wrote to memory of 3060 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 34 PID 1980 wrote to memory of 3060 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 34 PID 1980 wrote to memory of 1000 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 37 PID 1980 wrote to memory of 1000 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 37 PID 1980 wrote to memory of 1000 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 37 PID 1980 wrote to memory of 1000 1980 JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe 37 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe startC:\Users\Admin\AppData\Roaming\404FC\85DB3.exe%C:\Users\Admin\AppData\Roaming\404FC2⤵PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe startC:\Program Files (x86)\FC441\lvvm.exe%C:\Program Files (x86)\FC4412⤵PID:3060
-
-
C:\Program Files (x86)\LP\B3E4\650A.tmp"C:\Program Files (x86)\LP\B3E4\650A.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1000
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:876
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD5fe2d33bc40a44dd3173a9f41146c2370
SHA1821056c2091878e2f7fc9e9731a1d8ca2264a097
SHA25628fa3121fb2db391032e3013bc825084e8bb42bf6d8442b39c9dbf40c5b52498
SHA5127021ee1f3443d9a00199802aaa24feaae36073dadc84f26455ead5ecde09344444e04f7f3f7c9fbcb305e959dc69f34733273a66164fe15e13105464b299102b
-
Filesize
1KB
MD5b477c352ef29ef58c4317674f0ef6023
SHA1ca93fcc457c67c3509058b794146664387bc586f
SHA256cede342374aff61ce4680ec9ec12def3658a699f914ba6434f01d6a6299e48d3
SHA512fef0b5abe1deb140f13a491e54b3f2e8e0231b7360df20f3e270b9d02910a854abfd0267415db7b4bd9d0d9a8147de04334678174df69eb59d946b0932fb2a01
-
Filesize
600B
MD59203b45f4ef6948b7aa45ac12dc57f97
SHA1c9af71ccd40d2990b16e48ac0b68d711e593df4b
SHA256a4f785da2a1e9378228e439bdb7719670dd728b39dfba52326075dbf60bca5b0
SHA512741b268ae8a254e62a1d7153b63d104a6ea450613cef3f72e6af8f8dbb6597ae039c54436fec257520fca5672fa459cb557b2b938994097d5c7d95a230df5e74
-
Filesize
300B
MD5122baeca295632da75e00c317eae1c0b
SHA17650f252b28a787dcd77fa019dedca1764927301
SHA256b333e2e4398f2dfb343115a228ffb2b7784ec7cca7907f993943996c6e50937c
SHA512bf7a3757992d4d9c83335ddddd53babe3b5e122ae54e3f3a172fedf1f9929a2744430f7edfc856b29fedb54e62b7080485615951e113a5f9aa5429ac914b0d27
-
Filesize
101KB
MD55c6b17d72671a76ad9a632d1f588a263
SHA1b2af402370e7fa32e65286d7fc37a5772d863e1f
SHA256574046ed67b615c225e20967ed87f628b47e153f305f5fd03352beba7a521dc6
SHA512d715a64da7bb2f3ef0819c6801bf20ff83605ef505d70577f6b7ee0fccb8817c641dccea7d4a21608c10417e2377ed5092f55befc20469df455deba0b9959a07