Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    71s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 02:39

General

  • Target

    JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe

  • Size

    164KB

  • MD5

    1eb92c6a918c7f5bdce6dfdafe6b8411

  • SHA1

    2bda89cf5871ae9a62f7b3c575c1ae9dfb33fc59

  • SHA256

    ade0e5801f4ff308ee39d0fbfdb34bf17805e793ed15cba7d316edea41867d82

  • SHA512

    f3c4a87f9e12be454532de5da460b356b21e8a385ac6480976d05981c738bb40a862ed38e502d78d8175fa2f7fbba43c97c96f5984818537703354bb3056be0b

  • SSDEEP

    3072:CWq4Z3ph6NvDRj11srQnrFM1lh9aQXPzsvJaoUvD2FjxXvJaRtKNh2v9SxzYdjN:CWq4xD6N7Rj1urorYPnssqLxajKD2v8e

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2168
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb92c6a918c7f5bdce6dfdafe6b8411.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\6E7F.B07

    Filesize

    1KB

    MD5

    1531aad882c58a6bcc55d48e58d57226

    SHA1

    aedaf6e07147240833f4ecc284844bd706f2ecf7

    SHA256

    a559d1f90e6825ca5edbe6a1a5f4a890374ba9962f31076c25b6ae61a4e863be

    SHA512

    801f96c34478de96a6a88274232c556fb22cc5efebcb9ecdf29f668f91eafa460733c9d4c3b698a689f8877cfe0a1d08914412ef839f14c7cdf2ee396ce91a27

  • C:\Users\Admin\AppData\Roaming\6E7F.B07

    Filesize

    600B

    MD5

    1c10965ca79d61d3df384c3ec77a81b6

    SHA1

    bf6f927090363613c7222d2eb52960560bf6d6cc

    SHA256

    f40490d692463f0454ec26c8d34b50d5ebc1072cc2007442275a69cda2e9e622

    SHA512

    2744b1f2ca7adb616c4b9887fcc33af8cdf5c0dd93a616bd870e6d649b6804b3d593fb3995122b8b806cae86cf28e0081fa929dda1c38d2b20e5fc2d79d83157

  • C:\Users\Admin\AppData\Roaming\6E7F.B07

    Filesize

    996B

    MD5

    00dc00116fc0b3c6ee06c29583b4df67

    SHA1

    e3db4794e58b7348e029232d797b376659fa76df

    SHA256

    9ef805abbcb68d61b95c1b6f691ffe4afe30e94dda7a15361e1544ccb3f24ea0

    SHA512

    438b87e5456aa11fb05bdc8d57f94c3695b5cbd4ab8e18108992a706f47c75fa33d666fe4453eb370b1574f88ffca523147c352b8b874747f771d2b6ece4b550

  • memory/1836-93-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/1836-92-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2168-5-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2168-7-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2168-6-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2608-15-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2608-1-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2608-94-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2608-2-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB

  • memory/2608-197-0x0000000000400000-0x0000000000445000-memory.dmp

    Filesize

    276KB