Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cd7518d02710de44c12bbddd84dcbda6_JaffaCakes118

  • Size

    4.0MB

  • Sample

    240405-jdd73see2v

  • MD5

    cd7518d02710de44c12bbddd84dcbda6

  • SHA1

    4cd62044f30bbd5ad81d6feee4124e77fa1c4ca5

  • SHA256

    06c95ac7a109d3133013852cc5ca608e9e66a6ad9e43c5630aeeebd802c55202

  • SHA512

    1fc5b3ce3aa9ef460b53e21f59ed83f6cc8fafe50109d18fffea141467bbb3d5a23e2543174f9bfa9b26230d570c806a351b3bce6699c1d4075c8b09bbcea896

  • SSDEEP

    98304:LG/uzGNV9HkPtzaLv1NwqRR3TT8uWv3ai:LG/uzGNVyPtivrwqjThWy

Malware Config

Targets

    • Target

      cd7518d02710de44c12bbddd84dcbda6_JaffaCakes118

    • Size

      4.0MB

    • MD5

      cd7518d02710de44c12bbddd84dcbda6

    • SHA1

      4cd62044f30bbd5ad81d6feee4124e77fa1c4ca5

    • SHA256

      06c95ac7a109d3133013852cc5ca608e9e66a6ad9e43c5630aeeebd802c55202

    • SHA512

      1fc5b3ce3aa9ef460b53e21f59ed83f6cc8fafe50109d18fffea141467bbb3d5a23e2543174f9bfa9b26230d570c806a351b3bce6699c1d4075c8b09bbcea896

    • SSDEEP

      98304:LG/uzGNV9HkPtzaLv1NwqRR3TT8uWv3ai:LG/uzGNVyPtivrwqjThWy

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks