Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 12:41

General

  • Target

    cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe

  • Size

    165KB

  • MD5

    cd0e91bba7713d1a7c66d50c4f9aed90

  • SHA1

    fc4dde2537881ce341b8054fe64a9659a235bfaa

  • SHA256

    31517a026e70dc7b2620892bc48f86cf1ee219bfa0da56802184f4a30fd6b095

  • SHA512

    2a1eb564056bb3ea26d4ec36ba1c88482ec7fb26b788dbcde7389f654400403519d0d9c82ec544694e668ddbebba0b3a28ca4e70bf0e452764a6b5ada50615a5

  • SSDEEP

    3072:EfkfcHxa/ZrtSBnZ+k2/d7V2g855t1dRTvydaDgA+XtZ4X:akfcHxaRhS7+kId/85zLRxgAiZ4

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2324
    • C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\cd0e91bba7713d1a7c66d50c4f9aed90_JaffaCakes118.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\38A1.878

    Filesize

    597B

    MD5

    178fb5f6909ca4e576cddf3e16612df1

    SHA1

    64591df7ccb021fe012c68100968a4db95e4a374

    SHA256

    dc40162ebef08c2e3ddd1694ae8e84304831d434bb0f62b261acba5fc39997df

    SHA512

    4442b6f720c55be6b6b9308d1ee4a3ae91a8ca1a854882fdc21b0169b33228fb331b1dcae5bc10f4147d8f8ef41d2771ba30780b74e1368e942c4e281fa5d087

  • C:\Users\Admin\AppData\Roaming\38A1.878

    Filesize

    1KB

    MD5

    5e010bcc94abd6e6006f7a86f9daef3d

    SHA1

    e7703d42605b859233b4ce8e63d354484e209d9b

    SHA256

    daf6917e27d91edc5267fcbb570486e2f19e1d97c73ca7e3fb953db49b7494c8

    SHA512

    c2762e4fc47343c3996d105f62bad32ed9c185b5f9d5f623fc3dc188cae93a11b90f3e14dd32d2ec2c249df82892f61d4b8d0f9ee6b2ceaf1821202fabd42c27

  • C:\Users\Admin\AppData\Roaming\38A1.878

    Filesize

    897B

    MD5

    1ab8821b6fbf6f824c533a3a24f70c51

    SHA1

    452f8849da7e2085a55bdccbcc996362097a3342

    SHA256

    f2b62a18a8f69d89bbdb28bf9503a5961679b70a4adcd070a321e33e1d76db77

    SHA512

    ccfd1757cdb3ebc013423c58b54797108886cb69c76e51a12e724774b15bdab9b906ce4a7a82b5e23cf0b1889684b3f3039838b3a8e56703857f235ba7291c8f

  • C:\Users\Admin\AppData\Roaming\38A1.878

    Filesize

    1KB

    MD5

    c5d792b664812063ca4df6d226f53dc6

    SHA1

    5e583abfc5e77771c09dc4d273401646e7bd8d1b

    SHA256

    ef7f6d3a51b7d29ca15ee2a0d93765996db1616bb92e5692fdcef6092d95a9f2

    SHA512

    fa38eef8dbbbc6e275f5f7c12099370b65791020d9813698717fbebeb4bb2c1f5c3d9b9798438e32f5d6909536f361908e4ffe6f2fef549fa6c92b807883b232

  • memory/536-94-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/536-92-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1684-21-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1684-1-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1684-155-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1684-167-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1684-2-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2324-20-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2324-18-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2324-17-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB