Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 15:32

General

  • Target

    JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe

  • Size

    180KB

  • MD5

    642b1107928e464d62ecbfb0a58d69a9

  • SHA1

    13d4d20c816f93811d12c14f15b3f004ca34afda

  • SHA256

    39f52488b240e3e976bc1a73740fb6036f2dd9baa642fc3450dc85e6e8be0e71

  • SHA512

    23f0d15e8dc077327676f4f8cba1bcd2f74a4ace62ed445322483839262afa5b4367b81bd2f19a84209a4927201a7bef3d58a644d02a5a6f80f63462e13ed7ab

  • SSDEEP

    3072:odcJ44+mge3ZvIPx5uwtF/7DK6MVs5ZeJANEijUdoFqB6ePf4W2XPF:o+S4+pe9IPx5uwX2Rs+KEua6+Y

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe startC:\Program Files (x86)\LP\D45A\530.exe%C:\Program Files (x86)\LP\D45A
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2156
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_642b1107928e464d62ecbfb0a58d69a9.exe startC:\Users\Admin\AppData\Roaming\A0550\0B7D4.exe%C:\Users\Admin\AppData\Roaming\A0550
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\A0550\099D.055

    Filesize

    996B

    MD5

    0a0d37a187bc3ea185a584ca24a2dc51

    SHA1

    9453fd59ae16fabf487cb4bef7a3e3bcbbcd57ee

    SHA256

    89311e3815bca74ebfc8415536e241b8773173d528f6983eb217f737eda92990

    SHA512

    b328df173dc0b975f2a2ad2518b164d6e7b2966c5d46c0b49844e191b7c612abf1c3f40585981d8b5f038c1f1c98a4619d04a05bf34a42f97e14e4bd132f83ef

  • C:\Users\Admin\AppData\Roaming\A0550\099D.055

    Filesize

    600B

    MD5

    68614c97e16902c3a474050f40b341b4

    SHA1

    abcc05ca3c8d7763924727d26b8a16a105f8344f

    SHA256

    8aa5f9bcac7c0562181a556ff72879176d558027131ca20a12dfc326776bc96d

    SHA512

    d760b69a49fdf7d34f0589dcc3fa98364f4110b79363fa727ed6746f0a0f6e827bd47b1f250d51eac262a2fa69d9749ca9a765e7f481602208d79c9199164981

  • C:\Users\Admin\AppData\Roaming\A0550\099D.055

    Filesize

    1KB

    MD5

    6564bd51f8da7a741b3b7fa49e40ec53

    SHA1

    5d7200f3cc2ced8abb5ec00207fe167697fc3007

    SHA256

    cc2f702903b585f673b6cd921e802e626d373d4b4ea9a1351d38da6224481248

    SHA512

    a5b638e996641f3731edac1e0c26e16f51639368f0f7d5d562c3197865a4a5ca9215b30dfba2af05546d099b8b6efd994f1a680f211c10ed2cdd256b20528b51

  • memory/2156-13-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2736-0-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2736-2-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2736-3-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2736-15-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2736-16-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2736-298-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2752-147-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2752-148-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB