Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 15:28

General

  • Target

    JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe

  • Size

    164KB

  • MD5

    8fb470d1b4b6d67a3970d3c7b9e8f1e5

  • SHA1

    e534f165db10cdf48e90b91a4777c6a8bf6827be

  • SHA256

    aa61b3486a63f701432f1341321ced553149d7b084e4a0e3d28340a4033c08c9

  • SHA512

    1eb7c9c52d228c50c949ef5b2a7901671e34fb7571220498848f52aa2daf44418d0dc5c4f71e8a00b6d1e3ac3496e74ba7f02471bc10cf99a1744fea97d86785

  • SSDEEP

    3072:dQgbMCivSMirg3J5UFXZ6R2CHykeANfyeBpMVVDKov1jAjW:Sms3J5mVqytUKeLMjP8y

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1740
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8fb470d1b4b6d67a3970d3c7b9e8f1e5.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\73D8.8E3

    Filesize

    1KB

    MD5

    b7629f8f0b4c5002c74ef73764e317ad

    SHA1

    49323c351ee4aaef72fc34b8a5081771fb5eb0de

    SHA256

    b45b0832336e6f63411adea9e70f7621fa7379d50292d8458301fb66b70c08e4

    SHA512

    a36a1dd928f68cf633d85855282b8d2a8f9f8774b07a5d7791675accc6d7336d81f94bacd3f7b2d51e9cc952d6333317cdee70eeb4b1164b5d422fddb5219355

  • C:\Users\Admin\AppData\Roaming\73D8.8E3

    Filesize

    600B

    MD5

    4f808f03777f7d3d7267c039d9ad6438

    SHA1

    d70a475506a65f62696f2d55a7062269168ce65e

    SHA256

    dc313056efd441276b893c8a2b5105efa031b230f86e2adfa3e33c37008f3cbf

    SHA512

    388e57d2459cbca729f1fb5b535fa20fb263f4a0df2ad933a4ed7b005d7df83bdf7cc93d12fd92e87789f15efa1485089f0df21c3050bfa68df61bc9ac941f53

  • memory/1740-13-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/1740-12-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/1740-14-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2308-82-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-1-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-2-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-15-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-80-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-153-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2340-157-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB