Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e88ac908199e74958e0f6d4412760b87_JaffaCakes118

  • Size

    279KB

  • Sample

    240408-14648adc98

  • MD5

    e88ac908199e74958e0f6d4412760b87

  • SHA1

    814ebeaa37736b7dd23b7a92b4093b54e8aa9a89

  • SHA256

    d380d48ca3036eb5d99453cb17ae6f3afb0aeea85786e14198bdd182a0182f8e

  • SHA512

    1b1c766e97225b37555c4f1a0bda1d0ea4444daf13c5f994a9f3f9690b9ad7e165a3d7baec8cca2771008e4c68bb8dfbab71a6bf485df065619e92f6348a2c90

  • SSDEEP

    6144:m7O00l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:m75RGgdoz5LDsOddkUBc9M

Malware Config

Targets

    • Target

      e88ac908199e74958e0f6d4412760b87_JaffaCakes118

    • Size

      279KB

    • MD5

      e88ac908199e74958e0f6d4412760b87

    • SHA1

      814ebeaa37736b7dd23b7a92b4093b54e8aa9a89

    • SHA256

      d380d48ca3036eb5d99453cb17ae6f3afb0aeea85786e14198bdd182a0182f8e

    • SHA512

      1b1c766e97225b37555c4f1a0bda1d0ea4444daf13c5f994a9f3f9690b9ad7e165a3d7baec8cca2771008e4c68bb8dfbab71a6bf485df065619e92f6348a2c90

    • SSDEEP

      6144:m7O00l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:m75RGgdoz5LDsOddkUBc9M

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Disables taskbar notifications via registry modification

    • Modifies Installed Components in the registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.