Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 10:33

General

  • Target

    JaffaCakes118_27d1639875727974db376290fd391d54.exe

  • Size

    179KB

  • MD5

    27d1639875727974db376290fd391d54

  • SHA1

    45c0a5f21abbaa6c0dce67816fdab9bcf4fd693d

  • SHA256

    1b974a29763600ad330e8afa71cc3b00fa5e1b8a94ce02b4215b841f8c74df87

  • SHA512

    a5580a527a6db51bd7d47f6abd6982061f0cd894ec1b1f153343dc2adea583930c06e6f4d87e39613ebae3376ea7dae09f2b78f306356691013ef530223a22af

  • SSDEEP

    3072:u20pFVLHzjIDVZ1vvtFh1AgH+dXzglLnZPIm1wu6Ufk2JDHwDm1b3HsRZ:nYdHPa5R+gH+dE7PImBk2Nam1bWZ

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe startC:\Program Files (x86)\LP\7DC2\1E9.exe%C:\Program Files (x86)\LP\7DC2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2308
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27d1639875727974db376290fd391d54.exe startC:\Users\Admin\AppData\Roaming\26DCD\B3C7D.exe%C:\Users\Admin\AppData\Roaming\26DCD
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\26DCD\D35F.6DC

    Filesize

    696B

    MD5

    a95e2eba5632d48445f6949e70f2c6ed

    SHA1

    e7debafd059f4bacfeefd2425a5d3131d6f94d6d

    SHA256

    42c81769f1252374d4c505d44915d0f84f54f5d1cbc7eaead1553737f8dfaa83

    SHA512

    1a10b3e228a509d195d5e75cf8e94e438b145b9e854aea2815c3d7af3d8f85db7a6c27465ecb10d22e12d1284bac85036012950bdccb5e2fb72a12825885a5ef

  • C:\Users\Admin\AppData\Roaming\26DCD\D35F.6DC

    Filesize

    300B

    MD5

    8ed3e7462f2119c0152c1c5235aefd99

    SHA1

    78315b960cd3c815d97e26f171fcf41fe4caee23

    SHA256

    6f9245484f32694512d958699962b692cb61e9ee922c20164161afcaa80031ee

    SHA512

    cfe6f1b0a216df3a63229b6e939181f9a409146cd9cf720a668319256fdda85e03b5ec10b295d4daee6cd84ccf7d8e6ff1ac97f3855d665c55826d337827650d

  • C:\Users\Admin\AppData\Roaming\26DCD\D35F.6DC

    Filesize

    1KB

    MD5

    d03f367f216539a9c1fe11640d918963

    SHA1

    ba0e290da86d84ea078d12fd6381131866e51112

    SHA256

    d35da2b0c196d8ec9f6f4cfe2d53d2239e8715c9ee234c0207aab6d723323d15

    SHA512

    ac1a9106c6a39f3e49bcdc7dc09b86108abb26d9d5d3c342d0aca1d40c2ac60a4fcda5a5fcda93fee814a206dba7bf63d1187b7cbaad77bb788d981fe4721d9b

  • memory/2128-0-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2128-2-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2128-3-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2128-311-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2128-13-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2128-14-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2260-136-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2308-12-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2308-9-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2308-10-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB