Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 12:33

General

  • Target

    JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe

  • Size

    181KB

  • MD5

    2bae47087fb186faefdf1fec7a1d0053

  • SHA1

    08f7ce5175b31b7449ed57d97d51459c16638688

  • SHA256

    0e0f96787cb12572ccfa4ef5f9244fbf218a37dbaa5248f61e5fd5b8d364a911

  • SHA512

    bf1ae539180b9c0cfce984ae37d06d863f726b65f6a4e2bba5f2d16db5dbd2d433b8ac86b5db9fdbfc46523f014fcb06d3d465142f7de3a00125d492133f4f41

  • SSDEEP

    3072:qOm0gxELrERz+q2CloFU5uPQnRVifWRRKVxYYVxZQEvOU62BgWMYk:qagxAm+q2GVuPGRVi+XqLBvO1Zrj

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 4 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2124
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bae47087fb186faefdf1fec7a1d0053.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\D73D.C7F

    Filesize

    1KB

    MD5

    f2b96bd62b8e68dd2ee36caf7624bb31

    SHA1

    df74644a28ac51d648cf1dd445666dd6a14b95f4

    SHA256

    6af6cd4639a0d0ceaf9e66812243ee2bd02631a84093a17270a36552383949ce

    SHA512

    dd2a284230b19ede2d99bbfaca8b2e19a34668ee2b210f7ac8b1fd26215e5e095d21dc8ccb2b86d8b597fad8e940d09972e68a4aa922d33a2d8217b18ee9432c

  • C:\Users\Admin\AppData\Roaming\D73D.C7F

    Filesize

    600B

    MD5

    8ec2145acc44d56f802bafcdfe07ab1c

    SHA1

    c75baeef20fbf15c27729f2c637ca1c3bc4a552b

    SHA256

    4dcb9d37ff73df6d8951204f6d97d7ac25c64cf42defd560545800c96966e35b

    SHA512

    60199cbf84c2a7150f6a247a3cac1c5bd101cd285aad8d9756588c2153daec691515aa40379abb316cebc4836189a1cbaff3d853e2f81611492452db0927c4d1

  • C:\Users\Admin\AppData\Roaming\D73D.C7F

    Filesize

    996B

    MD5

    51819dc6ea60a4c394d4f0a766acd1d9

    SHA1

    53495cbc863be0b329d738d01094637bf9e494cb

    SHA256

    01ab2a31fc27d008f245b1ec7482ff2cccd20ab32e1400f20445b509f66c30d9

    SHA512

    a87d6cba0c3a904dec1d2ef1438676f2c963b3ce2ecc34f9cf4e84c624c5199745d49f37b984c7568fde46f8b12dead53e9b42520b9d219918ba6730bfdc7516

  • memory/1512-80-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1512-81-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2124-5-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2124-6-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2124-7-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2440-2-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2440-1-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2440-15-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2440-187-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB