Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe
-
Size
169KB
-
MD5
5191704b32ccd272c2de38d5bd5c7b42
-
SHA1
a90517ee06f3228b905f84267d5aeb622e471524
-
SHA256
c23c3bb2ca149de01aa29b97c70729b6731cca2d9e4078a041472880c3fe1c33
-
SHA512
5f7f6edadcbdf7f0b54ed6e4b8cbc201401e25be588bf63dd1903e628ff7b50880c1e74867787dde97cdec1d7358e0f589ba239d5512161c85d8359848592d8f
-
SSDEEP
3072:f/9h/w5RrC4LLxMSYjldWD0+n6IyjdAJD5L+cgFCNfmNFFbdsbff3sRo5c:n9Rw5R24LLySYjjjaem5ikGvRSs3
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2944-7-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2692-15-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2584-78-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2692-149-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2692-189-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe" JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2692-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2944-5-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2944-6-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2944-7-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2692-15-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2584-76-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2584-78-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2692-149-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2692-189-0x0000000000400000-0x000000000046A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2944 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 30 PID 2692 wrote to memory of 2944 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 30 PID 2692 wrote to memory of 2944 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 30 PID 2692 wrote to memory of 2944 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 30 PID 2692 wrote to memory of 2584 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 32 PID 2692 wrote to memory of 2584 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 32 PID 2692 wrote to memory of 2584 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 32 PID 2692 wrote to memory of 2584 2692 JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5191704b32ccd272c2de38d5bd5c7b42.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD57effecfdc44a8d5b0a34a9681a9e7ccb
SHA112aea3615149be4cebd92f1c573574d460897fb0
SHA256867f70db1319240ef4fbea4c5a96155f02307b865d3349076db37f643c894dfe
SHA512a56d286bf2e0d3b36e11f8a68f0f793b3b673a15c42b19627075a2c01478e44759ba2088059f9c7d757cb304da3c14ef8d7e990685730be8076af5a8ed16f01c
-
Filesize
1KB
MD5f25cf2a4e1b6a8140d9d9b665c86638c
SHA109aeb5d803544ba480099af4f3a33a9838d9c2d0
SHA2562b9ac0c67f0f5f3d43e821fc18ffd19ada872ad37a09234c0e7b8f35abd9a4c2
SHA5126625e5277872549e275240c1cdc205d308c9f3235b3fd4e8cfb228959a30d36489c2fd3629e4832fdc9e7420e22e32156c66d75b1f7dbb1076301c1b616a1e1d
-
Filesize
996B
MD53414f27c2ad361329764013b6f6004f2
SHA1d02d2fbcb2494f90d64dc01f5497a5ac2afd95a2
SHA256c2bb06334d9d4d84b6f28a2adb3dd7f1f6542b265342574f6c11a03ba5ff402e
SHA5123f9f5a032b771287a30b915e26fe3a8e641a9ab54da9ddb6ec2d60fe7bcc81fc5a28f6fe97226f2a87f51bfa0ecb830c6db8d2e06f3bc454525101a3b4bfcf8b