Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...98.exe

windows7-x64

10

JaffaCakes...98.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe

  • Size

    286KB

  • MD5

    2a2f3f3df3273a9ac5f4738c4a967098

  • SHA1

    ba68fca0c69789ba57838be26be308e3491bdadf

  • SHA256

    4c23d6e61a49e17a03c82983eeee86cae6601b262dab74413cc68799b83f3d57

  • SHA512

    22a61e8ccd9c6f4a75ef464cb7e655f6d1a7d2e13b05d0d8781faffbda1fef2f30851f82274f6b6d722e578217a50077613a6a9645fad7ed92adde36c2f5e5af

  • SSDEEP

    6144:S+bY3VvnzS6q9yZDR5HXjG1oa8SygKwaU+je5zgda2ma9Qwt7o0:fk3VGwJRwpbyzUWeydD7l5o0

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe startC:\Users\Admin\AppData\Roaming\1A34B\914AD.exe%C:\Users\Admin\AppData\Roaming\1A34B
      2⤵
        PID:2856
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2a2f3f3df3273a9ac5f4738c4a967098.exe startC:\Program Files (x86)\4BB9F\lvvm.exe%C:\Program Files (x86)\4BB9F
        2⤵
          PID:1664
        • C:\Program Files (x86)\LP\AD01\5A21.tmp
          "C:\Program Files (x86)\LP\AD01\5A21.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:896
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1680

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\1A34B\BB9F.A34
        Filesize

        996B

        MD5

        c1510988acf89555202d8cf474c219fe

        SHA1

        1d369d64782e91e75bd9e226fd7d404d415806f0

        SHA256

        28f95adc28b3440fd30cf655c1791155397b4657f8cb0b0e0992286cb295b6fe

        SHA512

        d45d3e3e9d34a8977a380a3cc61776a3d8d062a00a632f3f375d95cec8b5f4f7a4a10f1559d56bd24a53f48ff606f2f2f2dc84cbeb59458c5af4f00c1d0c76c1

        Download Submit

      • C:\Users\Admin\AppData\Roaming\1A34B\BB9F.A34
        Filesize

        600B

        MD5

        04ac04726cc79f33547be4f6c576f602

        SHA1

        4f3b9fc4270337eb7ceb1ef9ef514e3c68d7eaff

        SHA256

        ccbece89e7d74d02a436774f8ccbfd59d01cbc0ce17568b75dc6725bd174d752

        SHA512

        47eaa7d0788a36fab027e0fd922107076d7bef91510c7b225d966b7892f5ffcdc57dc940069c364be45885bb164317795093d91df33b02c148a6eb1fd52e445f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\1A34B\BB9F.A34
        Filesize

        1KB

        MD5

        164cea6f75fc2cbaeafd59a336751609

        SHA1

        969bcdd901fd5973e3605366c2402c898be03074

        SHA256

        c3173e31496be3fddffa8ffe7a449b8d41660d47622cf0ee6bdb401e9eb3a98c

        SHA512

        fb55dab57c55fe5497539454a6a265538a59c2e840ca55961424e61e42c3ed194dfce0b00b3e4e38681d347554310045fc84b5e6ba03b0d5a820349de449d08c

        Download Submit

      • \Program Files (x86)\LP\AD01\5A21.tmp
        Filesize

        101KB

        MD5

        80ac92fe81519a42cb9031ea571b7761

        SHA1

        fec55eedbe309ebaa847ae1b9b4680b1e357586b

        SHA256

        510567f9284db5bb61e1697b7befa5d940ad64be5b826db005094077682c42bd

        SHA512

        79e91e92bbb61b546943e3824f0fd56a8cd1b0b5c18d23b129286d12c906dc10a9540876af85268aa6236f3d97af69631d389cf486b6ed45e220e7cf0a35a42e

        Download Submit

      • memory/532-1-0x0000000000400000-0x0000000000469000-memory.dmp

        Filesize

        420KB

        Download

      • memory/532-3-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/532-2-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/532-179-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/532-4-0x0000000000400000-0x0000000000469000-memory.dmp

        Filesize

        420KB

        Download

      • memory/532-13-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/532-299-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/532-304-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/896-300-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/1664-178-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2856-17-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2856-18-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2856-15-0x0000000000400000-0x000000000046C000-memory.dmp

        Filesize

        432KB

        Download