Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118
-
Size
238KB
-
Sample
240525-vm73asbh28
-
MD5
72a89af065438ca5baba4e6ff6dd9f02
-
SHA1
60f1d8c7866c5a0b7bd9d6c51d593749d4a41b8e
-
SHA256
42b93254b754f4c8b4db78da230bd219e3cf6444f46369764939a6829fa62bb4
-
SHA512
8fc72da127c683346206cd1afd94a816f508835095c79058ca78463bbaa03bfe8f71883d390de5b3f24390cbc491066760c546ddecbd3a75ecd328cdee369a4a
-
SSDEEP
3072:qNdm6/Xbi5XJCp451wmxx+4s/SO/qtr5gNsPGRBU/u57tieksOe3XpljAFTvMQ55:qn/L+2uwm3w6O/EgNp55lO3Tks
Static task
static1
Behavioral task
behavioral1
Sample
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
HelpButton.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
HelpButton.dll
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Users\Admin\Downloads\README.hta
Extracted
C:\Users\Admin\Pictures\README.hta
Targets
-
-
Target
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118
-
Size
238KB
-
MD5
72a89af065438ca5baba4e6ff6dd9f02
-
SHA1
60f1d8c7866c5a0b7bd9d6c51d593749d4a41b8e
-
SHA256
42b93254b754f4c8b4db78da230bd219e3cf6444f46369764939a6829fa62bb4
-
SHA512
8fc72da127c683346206cd1afd94a816f508835095c79058ca78463bbaa03bfe8f71883d390de5b3f24390cbc491066760c546ddecbd3a75ecd328cdee369a4a
-
SSDEEP
3072:qNdm6/Xbi5XJCp451wmxx+4s/SO/qtr5gNsPGRBU/u57tieksOe3XpljAFTvMQ55:qn/L+2uwm3w6O/EgNp55lO3Tks
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request
-
Contacts a large (517) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
a436db0c473a087eb61ff5c53c34ba27
-
SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506
-
SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
-
SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
SSDEEP
192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
Score3/10 -
-
-
Target
HelpButton.dll
-
Size
28KB
-
MD5
6a0cb229593ec529e5c7e62c67aa542f
-
SHA1
30888613c9f44d9fa4a0adb0e5d575343dce6be7
-
SHA256
a7c597241392090a4d01e164db834fd5252d97fb9759be1d9684813aab68ae1e
-
SHA512
d44855dfdb2f338373ec140b2cfb83141396cc0810dc684fdef26828fa63afff43116be89e4c8b31f99dd0c5c01b36d565b9b0dd2ab5ff1a41d405779a83bb4d
-
SSDEEP
192:J6NjmJDXVyPdWKSWEUb50riU6kEDVInh+g8Ok1/akYaw9DAw59X:M0zyzSbeCGUz+I+XXYaw+w5
Score3/10 -