Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6febfef814559223cecd46a376011b9a_JaffaCakes118
-
Size
2.1MB
-
Sample
240524-1t4aksce7x
-
MD5
6febfef814559223cecd46a376011b9a
-
SHA1
c1cbd367b8859834e56baecbb4adae006de66852
-
SHA256
72454e25fcf6428797f032ba6e5ab9a2c4a49c33fd3f353ce15b6c87979f4b54
-
SHA512
be52e9fed62afb08753c0af6513a3d0196c3ab519082bbf09973c3f5dd47da9978a24c39b09552684b443d76248e358d8053ea53b85036c009d26ccdd2c242b3
-
SSDEEP
49152:6MPAcFI+Oa9vb9cCp0RUFE9y6cthn/2mO7Vy/R5nsQ:6MPAcFI5+vb9cCQevhn5+Vy/Rt
Static task
static1
Behavioral task
behavioral1
Sample
6febfef814559223cecd46a376011b9a_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
cryptbot
bibinene01.top
moraass05.top
Targets
-
-
Target
6febfef814559223cecd46a376011b9a_JaffaCakes118
-
Size
2.1MB
-
MD5
6febfef814559223cecd46a376011b9a
-
SHA1
c1cbd367b8859834e56baecbb4adae006de66852
-
SHA256
72454e25fcf6428797f032ba6e5ab9a2c4a49c33fd3f353ce15b6c87979f4b54
-
SHA512
be52e9fed62afb08753c0af6513a3d0196c3ab519082bbf09973c3f5dd47da9978a24c39b09552684b443d76248e358d8053ea53b85036c009d26ccdd2c242b3
-
SSDEEP
49152:6MPAcFI+Oa9vb9cCp0RUFE9y6cthn/2mO7Vy/R5nsQ:6MPAcFI5+vb9cCQevhn5+Vy/Rt
-
CryptBot payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-