Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cb6ce8cf52be51750926054a8d44fa02_JaffaCakes118

  • Size

    152KB

  • Sample

    240405-fk5f3adb26

  • MD5

    cb6ce8cf52be51750926054a8d44fa02

  • SHA1

    95578a4403bd990c8d5ffdedd3c57cfbc35950a5

  • SHA256

    6b9291c0a62e23490fe5071aa59b3da603e337d34a4e03290d844fc57fa10f7c

  • SHA512

    a1d8e42ed813c0b9d49f718ebc75da30c710420d586a3515c837b3da7f6620e20700f8a26f156a676758e564c1258388255a3ad3f10ed8ba02ebee8b42dcd189

  • SSDEEP

    3072:QbA+I1EP6aR+OidaZmIYQ4bbP83Bo9s5vmEoeXdUZCXudfE3:ybKExgOiIcIYQ4bbP83Bo9s5vmEoeXdG

Malware Config

Targets

    • Target

      cb6ce8cf52be51750926054a8d44fa02_JaffaCakes118

    • Size

      152KB

    • MD5

      cb6ce8cf52be51750926054a8d44fa02

    • SHA1

      95578a4403bd990c8d5ffdedd3c57cfbc35950a5

    • SHA256

      6b9291c0a62e23490fe5071aa59b3da603e337d34a4e03290d844fc57fa10f7c

    • SHA512

      a1d8e42ed813c0b9d49f718ebc75da30c710420d586a3515c837b3da7f6620e20700f8a26f156a676758e564c1258388255a3ad3f10ed8ba02ebee8b42dcd189

    • SSDEEP

      3072:QbA+I1EP6aR+OidaZmIYQ4bbP83Bo9s5vmEoeXdUZCXudfE3:ybKExgOiIcIYQ4bbP83Bo9s5vmEoeXdG

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks