Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 16:48

General

  • Target

    JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe

  • Size

    286KB

  • MD5

    f12b041a97635889b604ba50c0bd74ba

  • SHA1

    50bba2a078e5e0532ac4a6b9afb65939e51f36aa

  • SHA256

    14471b11af9c7e955fe25f0f78d160641b54dcc0b44308122126301ababb529c

  • SHA512

    c699de93883ff00c89d34b431fcc33313f6c41036ba47f735d955a220785eb84190e3c1afd3874bfd11e66682e698beb82461fb741d6949b923c67e029c58d1c

  • SSDEEP

    6144:uaZSa/cYxwoM93zRWqHIqYHRx4EC8EKMCX7d1RqBQv:uva/zDMqHL4Pwd14

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe startC:\Users\Admin\AppData\Roaming\404FC\85DB3.exe%C:\Users\Admin\AppData\Roaming\404FC
      2⤵
        PID:1412
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f12b041a97635889b604ba50c0bd74ba.exe startC:\Program Files (x86)\FC441\lvvm.exe%C:\Program Files (x86)\FC441
        2⤵
          PID:3060
        • C:\Program Files (x86)\LP\B3E4\650A.tmp
          "C:\Program Files (x86)\LP\B3E4\650A.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1000
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\404FC\C441.04F

        Filesize

        996B

        MD5

        fe2d33bc40a44dd3173a9f41146c2370

        SHA1

        821056c2091878e2f7fc9e9731a1d8ca2264a097

        SHA256

        28fa3121fb2db391032e3013bc825084e8bb42bf6d8442b39c9dbf40c5b52498

        SHA512

        7021ee1f3443d9a00199802aaa24feaae36073dadc84f26455ead5ecde09344444e04f7f3f7c9fbcb305e959dc69f34733273a66164fe15e13105464b299102b

      • C:\Users\Admin\AppData\Roaming\404FC\C441.04F

        Filesize

        1KB

        MD5

        b477c352ef29ef58c4317674f0ef6023

        SHA1

        ca93fcc457c67c3509058b794146664387bc586f

        SHA256

        cede342374aff61ce4680ec9ec12def3658a699f914ba6434f01d6a6299e48d3

        SHA512

        fef0b5abe1deb140f13a491e54b3f2e8e0231b7360df20f3e270b9d02910a854abfd0267415db7b4bd9d0d9a8147de04334678174df69eb59d946b0932fb2a01

      • C:\Users\Admin\AppData\Roaming\404FC\C441.04F

        Filesize

        600B

        MD5

        9203b45f4ef6948b7aa45ac12dc57f97

        SHA1

        c9af71ccd40d2990b16e48ac0b68d711e593df4b

        SHA256

        a4f785da2a1e9378228e439bdb7719670dd728b39dfba52326075dbf60bca5b0

        SHA512

        741b268ae8a254e62a1d7153b63d104a6ea450613cef3f72e6af8f8dbb6597ae039c54436fec257520fca5672fa459cb557b2b938994097d5c7d95a230df5e74

      • C:\Users\Admin\AppData\Roaming\404FC\C441.04F

        Filesize

        300B

        MD5

        122baeca295632da75e00c317eae1c0b

        SHA1

        7650f252b28a787dcd77fa019dedca1764927301

        SHA256

        b333e2e4398f2dfb343115a228ffb2b7784ec7cca7907f993943996c6e50937c

        SHA512

        bf7a3757992d4d9c83335ddddd53babe3b5e122ae54e3f3a172fedf1f9929a2744430f7edfc856b29fedb54e62b7080485615951e113a5f9aa5429ac914b0d27

      • \Program Files (x86)\LP\B3E4\650A.tmp

        Filesize

        101KB

        MD5

        5c6b17d72671a76ad9a632d1f588a263

        SHA1

        b2af402370e7fa32e65286d7fc37a5772d863e1f

        SHA256

        574046ed67b615c225e20967ed87f628b47e153f305f5fd03352beba7a521dc6

        SHA512

        d715a64da7bb2f3ef0819c6801bf20ff83605ef505d70577f6b7ee0fccb8817c641dccea7d4a21608c10417e2377ed5092f55befc20469df455deba0b9959a07

      • memory/1000-345-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/1412-50-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1412-53-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1412-52-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1980-1-0x0000000000400000-0x0000000000469000-memory.dmp

        Filesize

        420KB

      • memory/1980-169-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1980-48-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1980-2-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1980-51-0x0000000000400000-0x0000000000469000-memory.dmp

        Filesize

        420KB

      • memory/1980-344-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/1980-348-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/3060-171-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

      • memory/3060-173-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB