Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2025, 16:58

General

  • Target

    JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe

  • Size

    185KB

  • MD5

    7c981c04bba0c25311f3b068b5de8957

  • SHA1

    b69217838fb48dbf43a89e3b02b4f46ba7dca0d2

  • SHA256

    18c9bddd29d170371f5658fcc4a848f457c417983038d48ff391cb09a33f65ff

  • SHA512

    448f8e51948028964ac0603452d2181d54ce396d075bbdc32ab74ae196e774dc8d4c36315639d423b14e63223977d6f351b5eb5a4e55a99916425c6f649e8a44

  • SSDEEP

    3072:CFkGPUL3oIEbXDuGtIXZ6OPKQmLo7xw87sXAICyEVHd+u8htw:hKULYIE3u8IXZ663mEW8ByWRn

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe startC:\Program Files (x86)\LP\EC05\379.exe%C:\Program Files (x86)\LP\EC05
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c981c04bba0c25311f3b068b5de8957.exe startC:\Users\Admin\AppData\Roaming\515EA\6B1EC.exe%C:\Users\Admin\AppData\Roaming\515EA
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\515EA\A3CF.15E

    Filesize

    1KB

    MD5

    b38e9de4e9844774eb56629d23408e4e

    SHA1

    039a6a02aef825bd7a4e68890e2de3bd4b56a894

    SHA256

    05796086d936bd03393ae29d15be51b0ff3c898c8586683c9f8667423b77c2b7

    SHA512

    7b4cc639cf1ec7400c03794e6af413ab0f04a04fc337703e1092a7e81192fc0861ecc174cbe8055fa54c696b2901117a8d7197369e61c7d917ea2dd513b3d5d9

  • C:\Users\Admin\AppData\Roaming\515EA\A3CF.15E

    Filesize

    600B

    MD5

    02da5997ac4855cae0ec232e5327e10e

    SHA1

    d66797a238308a7604e023ab0a615cfe53ae7fa1

    SHA256

    a75ef696cdc7f6145bd07bb324588b55974b3d6649b167262c4ed5eefa0f4938

    SHA512

    b89a123aa53217dc03a2dbf2ca63fde0a567d8dab625f9707f0cdf068e58f4cf47c26670da453cfc7f791845b7258b51d7b10bae95291dce7f65f7320df1965f

  • C:\Users\Admin\AppData\Roaming\515EA\A3CF.15E

    Filesize

    996B

    MD5

    e974c6be5e842128e06cbd4db90b019d

    SHA1

    36a9cd7f13d6cd6b07078784522d86f9cecd84c8

    SHA256

    7697421213680561b1f25720df969b08474da31eabefaa97e61cb80a0388c17c

    SHA512

    5287212fe1c420eda828f336a551239b8dfdbaf2072e7cf7156de3c2b7a0c5f5327c939a39d7b9e32cd04ea180c7104923bc8fb3739d157de0c3e80ef0ef9fb0

  • memory/2276-1-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2276-2-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2276-188-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2276-16-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2276-15-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2484-84-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2484-82-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2820-14-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2820-12-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2820-11-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB