Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2025, 19:57

General

  • Target

    JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe

  • Size

    164KB

  • MD5

    80824d132b2085ce3d1e42427be0be86

  • SHA1

    ed43d2b46941d24f35a515ac198fe9985e46e2c3

  • SHA256

    4ee84d560b8c29ef614b8315b53a1509b38d7bb612eb5f8d97f4674144439ed7

  • SHA512

    e919940ac42e978f75de78a26f3f3f502948f4c1f7b41da9f502aa397af4c7186a2717c301e6564934a3aaa67be292390b67436a165abf7c3221ba6ac5dc94c2

  • SSDEEP

    3072:zv9udLn9rh2HjT2jMAxgYcXYb9t8p1WCuA/eBMrPf/UbAC3wixb58I:zsLPqjeePWCuAuiUbv3wixbj

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1148
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80824d132b2085ce3d1e42427be0be86.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\F2F4.CA8

    Filesize

    1KB

    MD5

    f8069facd7f21923621d7fd3ff3f3216

    SHA1

    8ff617c323c3d5dc81f6bc4827b7aea753ecc785

    SHA256

    12dfe5e51c9ae9f3ccb26a364feb6da0b01875aeb8b630cca98c0d695e3835e5

    SHA512

    dd8972f7815c71f0c448f490953bd7d21a1bfbeb79b06957539cb22d251a1991d1f52bc2af124ba4611cdbd63f10cc1d3b32568ae81b187ae98b42b5414112cc

  • C:\Users\Admin\AppData\Roaming\F2F4.CA8

    Filesize

    600B

    MD5

    d29bd82361df44337a9b3a746b76048e

    SHA1

    9d082d712108ee4f5ef58936e88773938764610c

    SHA256

    ab59071e079a7dc792b0aa4157316c3ab98d3e577e93173480ff8aff99369566

    SHA512

    4e541d582115d2781e7c3342e464bc801e746d6d1cdc9000580b6268166fea8bf02b77b99397e7f9fbe6b8c6587c27ee9aa796c9b554c082f2c1b23e2fe79ffd

  • C:\Users\Admin\AppData\Roaming\F2F4.CA8

    Filesize

    996B

    MD5

    c3b7c57e399b175973aafedb7e0fccab

    SHA1

    3799c688b274434bee5ce76bf97f70c313b8dc60

    SHA256

    e0d1901fa058ddeb69caf626da5e6922d24521aa7be647c83b3a6ba49c27009a

    SHA512

    2026b2f0c885b61c35d9c5c8dcfa7de66b7e19c42bfaa6c0cf24531fb804bc4eb6d66afcacab2b71f7712779be50a0472e3345252b46e67a468345ef0ec9ea60

  • memory/1148-7-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1148-6-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2528-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2528-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2528-15-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2528-192-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2728-76-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2728-78-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB