Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2025, 16:16

General

  • Target

    JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe

  • Size

    167KB

  • MD5

    73a169e431975e2cee9ae449f16c4073

  • SHA1

    6d26afcd2cc020b032a43f8d2d8f1d2afc32621a

  • SHA256

    11b760b5d247727aeb2c6bb5596cf2127e9702fc800bcac6f211aa915849c2ac

  • SHA512

    594809de401e2e5e2274d16a3055f2d67973578577a7f33f92958a4f4de52a5da5646846e6d25b1a80ac0bef6389dd1d35010ef5571cc64fc2a0f2b8397d8baa

  • SSDEEP

    3072:QOXbTyNkYhsO1d3NTw8RgA/LqNExmHURwslnInWbUt+w/:vyNrhd1w8RDxmHURJlWWbU

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe"
    1⤵
    • Modifies WinLogon for persistence
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2428
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_73a169e431975e2cee9ae449f16c4073.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\AC5B.977

    Filesize

    597B

    MD5

    1650f800fac8e45e595d6d514a57efb0

    SHA1

    d47ad7fbf604dc3a0477cc6400120c308a61917e

    SHA256

    6b1a426bec0f0aa12e5d919a298b5c807d55b87b3cd2d04b97e46157b22b65de

    SHA512

    322efa0493eee1a091d04fdb02675c982c14a3d408ded75c2f8757cd3f431315f72bc8e0111c9f16ed82f52e821ae7d480e73909960496b7e85e35b6d3a7caf5

  • C:\Users\Admin\AppData\Roaming\AC5B.977

    Filesize

    1KB

    MD5

    193c0fba14622ae8b12e8e3293039e26

    SHA1

    80070920e900a9ca456fcdc7e5d556b24fad2513

    SHA256

    deb5fc3548dacfa885694fddc1795805a03f333025041cfa7ea5eb439c8100dc

    SHA512

    8bff371b26acaac3f73519d6a2963b67f0a4986ac3bf94792250a05e2f0f4ed6385c49b492bb5c361c63e567ba89c0566b0b9ff78bf4f99c416896d44a1cf3ad

  • C:\Users\Admin\AppData\Roaming\AC5B.977

    Filesize

    897B

    MD5

    07e4b3e789952ec11c3809a4e0f582c8

    SHA1

    1089902ebd98b6865fcc11856586eb00922ec4ec

    SHA256

    223f6fc71d67790e0ff80f014977787b547946c5b5db683fef356731c95f3ead

    SHA512

    64ab4d4c82a29a118fa95b7328b55598bb39d63686fd6ef8fd1a709e6b25dd491aa80e339611f2e85c7a0210e440db5a40962028c83f85e0f5178281b8bc58aa

  • C:\Users\Admin\AppData\Roaming\AC5B.977

    Filesize

    1KB

    MD5

    d3ad283c78638a17de77e3b9637e1d48

    SHA1

    6bffbbca16f62796d9830efef1535ad6c3102557

    SHA256

    1fde371d30d5b1d30aa9cea976ad17a7f9bcc4894e588835328a7ac785feb19a

    SHA512

    a7c98def9d9570b2a333555face30712a81a2a2da9e186f57a5ac61e1c8b6df6b91efe77802af6819a0a19f1c78097e5e69848eb132871e10fe17e251e9e7c52

  • memory/1048-1-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1048-2-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1048-192-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1048-21-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1048-84-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1648-86-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/1648-88-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2428-10-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2428-8-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2428-7-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB