Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
-
Size
167KB
-
MD5
73a169e431975e2cee9ae449f16c4073
-
SHA1
6d26afcd2cc020b032a43f8d2d8f1d2afc32621a
-
SHA256
11b760b5d247727aeb2c6bb5596cf2127e9702fc800bcac6f211aa915849c2ac
-
SHA512
594809de401e2e5e2274d16a3055f2d67973578577a7f33f92958a4f4de52a5da5646846e6d25b1a80ac0bef6389dd1d35010ef5571cc64fc2a0f2b8397d8baa
-
SSDEEP
3072:QOXbTyNkYhsO1d3NTw8RgA/LqNExmHURwslnInWbUt+w/:vyNrhd1w8RDxmHURJlWWbU
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 5 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp family_cycbot behavioral1/memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp family_cycbot behavioral1/memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp family_cycbot behavioral1/memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp family_cycbot behavioral1/memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp family_cycbot -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\dwm.exe" JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1048-2-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2428-7-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2428-8-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1648-86-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2428 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 30 PID 1048 wrote to memory of 2428 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 30 PID 1048 wrote to memory of 2428 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 30 PID 1048 wrote to memory of 2428 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 30 PID 1048 wrote to memory of 1648 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 32 PID 1048 wrote to memory of 1648 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 32 PID 1048 wrote to memory of 1648 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 32 PID 1048 wrote to memory of 1648 1048 JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe"1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft2⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp2⤵
- System Location Discovery: System Language Discovery
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597B
MD51650f800fac8e45e595d6d514a57efb0
SHA1d47ad7fbf604dc3a0477cc6400120c308a61917e
SHA2566b1a426bec0f0aa12e5d919a298b5c807d55b87b3cd2d04b97e46157b22b65de
SHA512322efa0493eee1a091d04fdb02675c982c14a3d408ded75c2f8757cd3f431315f72bc8e0111c9f16ed82f52e821ae7d480e73909960496b7e85e35b6d3a7caf5
-
Filesize
1KB
MD5193c0fba14622ae8b12e8e3293039e26
SHA180070920e900a9ca456fcdc7e5d556b24fad2513
SHA256deb5fc3548dacfa885694fddc1795805a03f333025041cfa7ea5eb439c8100dc
SHA5128bff371b26acaac3f73519d6a2963b67f0a4986ac3bf94792250a05e2f0f4ed6385c49b492bb5c361c63e567ba89c0566b0b9ff78bf4f99c416896d44a1cf3ad
-
Filesize
897B
MD507e4b3e789952ec11c3809a4e0f582c8
SHA11089902ebd98b6865fcc11856586eb00922ec4ec
SHA256223f6fc71d67790e0ff80f014977787b547946c5b5db683fef356731c95f3ead
SHA51264ab4d4c82a29a118fa95b7328b55598bb39d63686fd6ef8fd1a709e6b25dd491aa80e339611f2e85c7a0210e440db5a40962028c83f85e0f5178281b8bc58aa
-
Filesize
1KB
MD5d3ad283c78638a17de77e3b9637e1d48
SHA16bffbbca16f62796d9830efef1535ad6c3102557
SHA2561fde371d30d5b1d30aa9cea976ad17a7f9bcc4894e588835328a7ac785feb19a
SHA512a7c98def9d9570b2a333555face30712a81a2a2da9e186f57a5ac61e1c8b6df6b91efe77802af6819a0a19f1c78097e5e69848eb132871e10fe17e251e9e7c52