Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...98.exe

windows7-x64

10

JaffaCakes...98.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2025, 19:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe

  • Size

    288KB

  • MD5

    6d6ac96862dba2553b1cea744cb9b098

  • SHA1

    2ec4fc2997e945e7bbbc2ca8901e2450bbfb0fb5

  • SHA256

    6f15e663b8e8f7c997ba2fb522e6c34cde0aa28e96c8a38d998729e20f07b68a

  • SHA512

    25128967aae5f5fb574a42a7efb7bab3568957e43bafe39fb31e37ac1fecbc099509578c0d8e286b04ab54fa8fd541a403ec74e8ae81145f214ae612ce7f56d5

  • SSDEEP

    6144:xX8JXbMQUXu+9qjCTWeqKas8hiAHlkyvbhA5qLXtE8VZP6lnrlZdgpP:uVM7u+xWEAyeAGy8V168P

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe"
    1⤵
    • Modifies security service
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe startC:\Users\Admin\AppData\Roaming\8B262\15105.exe%C:\Users\Admin\AppData\Roaming\8B262
      2⤵
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d6ac96862dba2553b1cea744cb9b098.exe startC:\Program Files (x86)\6210F\lvvm.exe%C:\Program Files (x86)\6210F
        2⤵
          PID:2564
        • C:\Program Files (x86)\LP\0538\DF57.tmp
          "C:\Program Files (x86)\LP\0538\DF57.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:996
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2624
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x588
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2320

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Query Registry

      2
      T1012

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\8B262\210F.B26
        Filesize

        996B

        MD5

        6c8c8a88833b7e25038a6636444fefb8

        SHA1

        421defd0ca0f2643d1cc5fccf68d8842f18ff246

        SHA256

        18316c297ac0b4d967d7ba647cb1f4950206c95f184edb814ab3f1700f143804

        SHA512

        78bf1fcb942f6ac4749548025f311f1c837a80fb30587d91ff9c60f82fdff8182da525be940f18c917301550952477fc99c80ed7ab7fceef07571da1f4a9cf9b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\8B262\210F.B26
        Filesize

        600B

        MD5

        ecf08a7e806ab34c08fbb4a952ebc087

        SHA1

        ac054debb2061d6a9481135b7467707f0b8662d3

        SHA256

        0861351e9a089fee58862e7dbbb89b5d05dbe56d56a7d45df1730614b9e66157

        SHA512

        b3e219dcafa63b32adbb0cd078eff26fb38434a5348e5eb3d50d6e482200311382f537a9b7d3350a192f3d990ca02c40753a64d553780e8841bcdafd7c0c2fc3

        Download Submit

      • \Program Files (x86)\LP\0538\DF57.tmp
        Filesize

        102KB

        MD5

        3dd4e5cd0cb32f735268a740c647065a

        SHA1

        5e88431137152bf76f61d06b1c2086ecd5082a76

        SHA256

        a1cb303db454c3faa73fa6705c9a7ce126110615879047fbd579d2c813fba535

        SHA512

        37463297b6e127dc2689f2b998b14042189baa26727ab1770fc482035b09df2cd3f349fb11038fabde84d0b4a5a07bfc6b5c619001ddc70c9c37c0aa87b3fe04

        Download Submit

      • memory/796-1-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/796-13-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/796-312-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/796-306-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/796-4-0x0000000000400000-0x0000000000468000-memory.dmp

        Filesize

        416KB

        Download

      • memory/796-3-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/796-182-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/796-2-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/996-308-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

        Download

      • memory/996-307-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

        Download

      • memory/1472-17-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1472-16-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/1472-15-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2564-181-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download