Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f660b7279e4613eaa2f18e55a0954bcc_JaffaCakes118
-
Size
2.0MB
-
Sample
240417-wvcrsshg59
-
MD5
f660b7279e4613eaa2f18e55a0954bcc
-
SHA1
eda18cc4e4774885bfaae2c6ea4ae2f5e49c0690
-
SHA256
b24e1c522e4cde05978e17faa213ba34b0547b5aab4e9c3f318fc935516f01e1
-
SHA512
23a05ae4915cd807520bcb4ccdafc0e0fb0a5339e946ed628d25d6e6c650628bd38f886392f828c2f70628713c3fe703eee5551676c054173218aa5b4e874670
-
SSDEEP
3072:Cqu7aslM9lhLElGtSIs48417nFdcQ4FdHLDC62ftOS2N:CqrK
Static task
static1
Behavioral task
behavioral1
Sample
f660b7279e4613eaa2f18e55a0954bcc_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
f660b7279e4613eaa2f18e55a0954bcc_JaffaCakes118
-
Size
2.0MB
-
MD5
f660b7279e4613eaa2f18e55a0954bcc
-
SHA1
eda18cc4e4774885bfaae2c6ea4ae2f5e49c0690
-
SHA256
b24e1c522e4cde05978e17faa213ba34b0547b5aab4e9c3f318fc935516f01e1
-
SHA512
23a05ae4915cd807520bcb4ccdafc0e0fb0a5339e946ed628d25d6e6c650628bd38f886392f828c2f70628713c3fe703eee5551676c054173218aa5b4e874670
-
SSDEEP
3072:Cqu7aslM9lhLElGtSIs48417nFdcQ4FdHLDC62ftOS2N:CqrK
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2