Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...11.exe

windows7-x64

10

JaffaCakes...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_42295816978b4c1162f604b8cc98e211

  • Size

    841KB

  • Sample

    250127-wadhlazqbl

  • MD5

    42295816978b4c1162f604b8cc98e211

  • SHA1

    c63183321b3ef906b62569d901b6fc61530b42c2

  • SHA256

    77305518a1b2d8a76f3adaf7959dc850b5ed90ded43792ad26fb23d725505abd

  • SHA512

    6c28c638883f72e672c1796d243a77b80ff1be1d392b58fb236f8351ed002101f7066064d00ec6c127781e835eadad133cd4b11a0032df227ce5d7ee9aabb91f

  • SSDEEP

    24576:Y1ckXnJDH7oH1haz/5qgxuLh62tLqazx5QwLzyUSSykQ59aIkPTr:Y1v3Jz8H1hU/5qgQ62Bqad5g0yksxkrr

Score
10/10
cycbotmodiloaderponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_42295816978b4c1162f604b8cc98e211

    • Size

      841KB

    • MD5

      42295816978b4c1162f604b8cc98e211

    • SHA1

      c63183321b3ef906b62569d901b6fc61530b42c2

    • SHA256

      77305518a1b2d8a76f3adaf7959dc850b5ed90ded43792ad26fb23d725505abd

    • SHA512

      6c28c638883f72e672c1796d243a77b80ff1be1d392b58fb236f8351ed002101f7066064d00ec6c127781e835eadad133cd4b11a0032df227ce5d7ee9aabb91f

    • SSDEEP

      24576:Y1ckXnJDH7oH1haz/5qgxuLh62tLqazx5QwLzyUSSykQ59aIkPTr:Y1v3Jz8H1hU/5qgQ62Bqad5g0yksxkrr

    Score
    10/10
    cycbotmodiloaderponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealertrojanupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies security service

      defense_evasion

    • Modifies visiblity of hidden/system files in Explorer

      defense_evasion

    • Modiloader family

      modiloader

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • ModiLoader Second Stage

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Disables taskbar notifications via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.