Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 12:52

General

  • Target

    JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe

  • Size

    163KB

  • MD5

    8c39ef4c2f9312349b98cf54f973c695

  • SHA1

    f5a539f5f23b4e0de3d3d0a669d650d3c0906e53

  • SHA256

    71dcd24da257c7bb0873fd9c276b7a463c9b85429589a338ae2e28787ae378c7

  • SHA512

    31222a884abb443cc449bd03d0a4c4987e23cee7c4a909f724acd9103d5b0acf696a855574761872a8ffe910343912ff41019f0baabf09488417c7351d48f520

  • SSDEEP

    3072:VE7bLMhkEUXRTAMszsW6tmfc67cW6troxFKjs5quCwuHT8dL7srl1WzlR9F3:VE7bLMCTAMsJjfP76B24A5q/HYdL7sJk

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 4 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2800
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8c39ef4c2f9312349b98cf54f973c695.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\016C.A8A

    Filesize

    300B

    MD5

    467d983f6b6860b3404e79d0fead8623

    SHA1

    60ba36d35847ea6e7ffcedd048f2e653027c2f95

    SHA256

    712940a2064305e644bfecdb12ca57fb51af47c66f2b99806fc2fa9280601a60

    SHA512

    e4bc0087b14d6fe7d652af92552d0d47a7bd8a488087304d1c5128d58a1bd0eaf6500a087b4b902fda89f5f30d3020934fd53554aa101d6c4f0f7e146529a0f5

  • C:\Users\Admin\AppData\Roaming\016C.A8A

    Filesize

    1KB

    MD5

    521c9f87aa1f4a96396ad5f5a5beb062

    SHA1

    e2c0694b8e3c25c5dc53bb809eaa99abccba6a77

    SHA256

    5d1ac155b2b7a28a64357384d6b4acec0fa8fdf449c76c04f55d4c3e8077ca0c

    SHA512

    ca4f7f6e335cf5494de5f8cf9251b16db505deb5e94e37f2cd2fdda0c539ee04da5c58dfd9dcd3047b2f5d2f8337977dd154d7942e6f65dcbfb142e5c8261994

  • C:\Users\Admin\AppData\Roaming\016C.A8A

    Filesize

    600B

    MD5

    1aa366a44525dd64ad8c23bba8d91413

    SHA1

    39c2ec6469c678129a808d65559e4af49323bca3

    SHA256

    78f7c6b7c13c68f0fd19cd69d1602cffb1ae63746329fbf4ad208716dcf82f26

    SHA512

    7c4bcfee7c07a97d43f9e1d833eb84c713d2aaa69382c5a050eefe7d044277dde276e4a8096c3c8019149db4e19c8d66fe83c60ce8955ef2579fb3ebc6cd7bdb

  • C:\Users\Admin\AppData\Roaming\016C.A8A

    Filesize

    996B

    MD5

    f59e1894d6094564ba69bade2aa2fb93

    SHA1

    f641c3ac97b3fb6a6609a002c2e50973d55a3149

    SHA256

    0d4450c68cc3259bf6f3346e7d0bd13fbac60d0f468ad9dd87c433ba88451072

    SHA512

    bf821a2831386395b32d018d949102b3ecf2265224541b185b8434d7a26aa918872a3f9f22fa7ce6829f026f7811bc8e13d108e45eb8c3bfc0c3844004d1c1b3

  • memory/2656-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2656-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2656-16-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2656-195-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2800-5-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2800-6-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2800-8-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2952-77-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB