Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 06:52

General

  • Target

    JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe

  • Size

    180KB

  • MD5

    23a600f3feb8a4c97be5b340d8a23d22

  • SHA1

    69e0ae6e0f7a1bde2c0181061f5464e80adc6921

  • SHA256

    a70f764ae1eb6ae3fb5ef599b86db3a0847c148d86546ae0566bf9abb8686a77

  • SHA512

    ec0246ad77c59b3f8b2fa4aeb13b3cf51cfbcf99988d3bc8cfcfde0f82c4a67200b1a5e2fc4f7063152d737c55cab843c9e5748f6e4ca89d3f31903db2196d17

  • SSDEEP

    3072:ZLcyLkwnNCCNWPUTymCveMrNfLGJkJZZHC4jfqhPiqi2ZgRDrYmeRXCd:ZrLkHCNJb4dLzJZZHpSPJ8TP

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2088
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23a600f3feb8a4c97be5b340d8a23d22.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\3129.8C8

    Filesize

    1KB

    MD5

    dbbb4726cbc63941f4451a31117a7697

    SHA1

    b95b174592b52ed5996614a3de536a0d3dac8dc2

    SHA256

    b2ff7b824028aeb5ec99e0d9caa343ae88ba98995304b428833f0a111ecbd17d

    SHA512

    6de6b04b0213aea546c27061c89809f9ed2de671cdce8b74e847b1775c5b915a1c0167227d40d31dea220e0d9c8b3afc6c9ee0ea9d6e2e6ba82d4d70cc1a2add

  • C:\Users\Admin\AppData\Roaming\3129.8C8

    Filesize

    897B

    MD5

    08434fe0e91e08b1d0cd9be98f519348

    SHA1

    8eee3761c9ef8c705a5fc5bc2593852a0707de03

    SHA256

    21ac89316802119835e38a07914a21b63ea6d8285fc6e7db4cac7eafcaee33d7

    SHA512

    680437315eafe28489e937d5e80f5f2855b8a12c84fdeda1a4e6d5faaed9c12e40233bc4e8caabf64e3476511efe914406eaedb6bb8def4b766b2af30a3ddb60

  • C:\Users\Admin\AppData\Roaming\3129.8C8

    Filesize

    1KB

    MD5

    6d04087d3e665c0c8cfee4af18e2013e

    SHA1

    6c15d4edd1dce8f1a8a11c33adf33701f373c052

    SHA256

    2e0fa90de681132f3962b534e60eea452e2a30e29b5a22963a4c7dbdb3d9397e

    SHA512

    701b483d4f86f7731f27c965e6d7861caad8f765d307f5a1298218210ddc57c9cc05a794ab932e014c909e82914ef7c55f921157e3720641e4cb15138ea97100

  • memory/2088-7-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2088-8-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-18-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-1-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-78-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-2-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-175-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2112-210-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2636-76-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2636-77-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB