Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe
-
Size
180KB
-
MD5
642b1107928e464d62ecbfb0a58d69a9
-
SHA1
13d4d20c816f93811d12c14f15b3f004ca34afda
-
SHA256
39f52488b240e3e976bc1a73740fb6036f2dd9baa642fc3450dc85e6e8be0e71
-
SHA512
23f0d15e8dc077327676f4f8cba1bcd2f74a4ace62ed445322483839262afa5b4367b81bd2f19a84209a4927201a7bef3d58a644d02a5a6f80f63462e13ed7ab
-
SSDEEP
3072:odcJ44+mge3ZvIPx5uwtF/7DK6MVs5ZeJANEijUdoFqB6ePf4W2XPF:o+S4+pe9IPx5uwX2Rs+KEua6+Y
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2156-13-0x0000000000400000-0x0000000000455000-memory.dmp family_cycbot behavioral1/memory/2736-15-0x0000000000400000-0x0000000000455000-memory.dmp family_cycbot behavioral1/memory/2736-16-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/2752-148-0x0000000000400000-0x0000000000455000-memory.dmp family_cycbot behavioral1/memory/2736-298-0x0000000000400000-0x0000000000455000-memory.dmp family_cycbot -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2736-3-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2156-13-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2736-15-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2736-16-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/2752-147-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2752-148-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/2736-298-0x0000000000400000-0x0000000000455000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2156 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 30 PID 2736 wrote to memory of 2156 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 30 PID 2736 wrote to memory of 2156 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 30 PID 2736 wrote to memory of 2156 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 30 PID 2736 wrote to memory of 2752 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 32 PID 2736 wrote to memory of 2752 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 32 PID 2736 wrote to memory of 2752 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 32 PID 2736 wrote to memory of 2752 2736 JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe startC:\Program Files (x86)\LP\D45A\530.exe%C:\Program Files (x86)\LP\D45A2⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe startC:\Users\Admin\AppData\Roaming\A0550\0B7D4.exe%C:\Users\Admin\AppData\Roaming\A05502⤵
- System Location Discovery: System Language Discovery
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD50a0d37a187bc3ea185a584ca24a2dc51
SHA19453fd59ae16fabf487cb4bef7a3e3bcbbcd57ee
SHA25689311e3815bca74ebfc8415536e241b8773173d528f6983eb217f737eda92990
SHA512b328df173dc0b975f2a2ad2518b164d6e7b2966c5d46c0b49844e191b7c612abf1c3f40585981d8b5f038c1f1c98a4619d04a05bf34a42f97e14e4bd132f83ef
-
Filesize
600B
MD568614c97e16902c3a474050f40b341b4
SHA1abcc05ca3c8d7763924727d26b8a16a105f8344f
SHA2568aa5f9bcac7c0562181a556ff72879176d558027131ca20a12dfc326776bc96d
SHA512d760b69a49fdf7d34f0589dcc3fa98364f4110b79363fa727ed6746f0a0f6e827bd47b1f250d51eac262a2fa69d9749ca9a765e7f481602208d79c9199164981
-
Filesize
1KB
MD56564bd51f8da7a741b3b7fa49e40ec53
SHA15d7200f3cc2ced8abb5ec00207fe167697fc3007
SHA256cc2f702903b585f673b6cd921e802e626d373d4b4ea9a1351d38da6224481248
SHA512a5b638e996641f3731edac1e0c26e16f51639368f0f7d5d562c3197865a4a5ca9215b30dfba2af05546d099b8b6efd994f1a680f211c10ed2cdd256b20528b51