Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 04:27

General

  • Target

    JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe

  • Size

    163KB

  • MD5

    bd535bd28911efcc5f1236fa7903097d

  • SHA1

    9ffa40211e2b84bfdb8f6b94eaa97f0fb0f4e454

  • SHA256

    4cee0498c5648f19f40bccfb29fbd12adee24fb3a67551620cd8bb04ed53d298

  • SHA512

    cc6197cd240e0dd983b4f400082e572d360e85132718f95ddec870c975d15934b3b83e6115e7473261ef78f56d120c690664204ca977f410302b61be59103c49

  • SSDEEP

    3072:kisGEV8ThYW2AlDSRrZ9+iK3ATcBdwscGApAF3U66edfnBhWi:kim8Tll+lUMpAF3Z6eBBk

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3056
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd535bd28911efcc5f1236fa7903097d.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\0408.7F6

    Filesize

    1KB

    MD5

    f56e872d0fb238eb6787c298a73be107

    SHA1

    3a388d3523fd9b88dd4de9e24bda1c59af4306ec

    SHA256

    0274ad194a34e8bdf61b8017a0ab97f7089da6346fe4368f80afe4eb325cfd5e

    SHA512

    508fd4ed34e098adb7f4369f457c1528cfc92d8c7f270e92bd04aacb1508a8a2cfa1171b579808d2830f909cef838b88cf6930efea21d5c5c5f178927ba43bc2

  • C:\Users\Admin\AppData\Roaming\0408.7F6

    Filesize

    600B

    MD5

    f9196f1d16347e06ef10c65fd46a24e5

    SHA1

    09409b98fb022af53272f8723fec4d71097f122c

    SHA256

    9b5d26adff5af7efb507f146995226396e52a5c276fb5026d812f3081f4677a9

    SHA512

    54ceacae44a9c70bde04e9e0031ba82a88d2f96cddd937ee64152564b185aa3d442f1b02cbf13bb9cee41b38a20cd4224d64a3c0ef70351f200b405f7f0b8164

  • C:\Users\Admin\AppData\Roaming\0408.7F6

    Filesize

    996B

    MD5

    f08603be3243d0b4047dc01c163329e3

    SHA1

    19ecfc5ea59534ceb5b9e7602a0a90c0880145dd

    SHA256

    70ccea48436ee865c7d5e232d1586651c2dec3b86d7b8e165e66fb74bdabd6ab

    SHA512

    0458d8448e7d07128791b20a4f86ff08643f8bcee567e66413d0690df3a8a7019602e5bab713fb5f7006ce28897d13f0794e40624fad963bc5c09f8ef6844358

  • memory/768-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/768-2-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/768-15-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/768-185-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1412-79-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1412-81-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1412-78-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3056-5-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/3056-7-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB