Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2024, 06:46

General

  • Target

    d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe

  • Size

    182KB

  • MD5

    d121faa3f6e90d545441cbc0340028d3

  • SHA1

    0d23698099d257127c4ec31316375b1ecd6c4d8d

  • SHA256

    e90c5722c7b1a0911acfbe99c939e855d44b57c732ac860a4411929895a74669

  • SHA512

    2275665d9bf7e2a7e043d87c0099271d209dc0ec9e42fea650fd78e7693d368511815fb26b0496f7b19632dd1e011a766e4bf81fb63d4b4a16469f54d1067a54

  • SSDEEP

    3072:U+A3w0NSJk5wD+hveJT7Mp2MDw9pI9R37IKIm7fgV5udVQ:b2wZJnChvC8p2MDwPICm7YV

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d121faa3f6e90d545441cbc0340028d3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\B09A.84F

    Filesize

    1KB

    MD5

    818ae28c022dc4c332a34d8ae10b5169

    SHA1

    9f10a2a0acffeffb142fdacb5a7762b4954ec03b

    SHA256

    7a0035cb48124eb1807c11c65d2f16b714efcb863a21ef1f45e17d64630adc63

    SHA512

    fda42e85f6343f36f2809d82bd135d0dbc3e7512e8a324f3aa4dbafe886659798963da29487e1db0c39e45905a3cc414c61b125083f9cba5ac629a5526a71aae

  • C:\Users\Admin\AppData\Roaming\B09A.84F

    Filesize

    600B

    MD5

    601cfba884e1e7ce9c156429465bc143

    SHA1

    f6b85d9628b73c0dc7a7bb81fd7c2d6cb5e2c9ad

    SHA256

    00618c3aa73dddee84a125163e6366ae6077674a1ed13a67b13d2c5f40dd5692

    SHA512

    6211f130965eca3903b676ef8b8230fd9930cce7a6f28add1dc9f09f648b2a075d818b35be9fd3280e675c2f9d0f9b198db2ba33aa1a86253d09aec9c017b95b

  • C:\Users\Admin\AppData\Roaming\B09A.84F

    Filesize

    996B

    MD5

    f38c6cc0b1ad86f74fff92277ad24ee6

    SHA1

    e1b4b01ad5be5cf719c1e5fc89c057bf1f09cca2

    SHA256

    ede371403b483b3dc2000ceb1fa101642e02273b87355c13ccee52fa60b38074

    SHA512

    40377d1ae5e8ae5b182ee4247a88f46fd2d27d4fe1e93548c939e082893734bae3e7d90abd799d2dd5cf1fa556d4a72a87b765404b079416c6ed65e47ff92725

  • memory/1064-10-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1064-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1064-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2448-84-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2448-86-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2468-1-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2468-15-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2468-162-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB