Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
99eee6816b1dbbb80cbb5082d2c82414_JaffaCakes118
-
Size
232KB
-
Sample
240606-eptppagd3w
-
MD5
99eee6816b1dbbb80cbb5082d2c82414
-
SHA1
cdbbc3d5d09d481038096c24a24a8d48c33e0adc
-
SHA256
fb51a8c32c9ab73b839799473f21113702599eb2708cedf5e5b3cf1e4a1824a2
-
SHA512
6cda429229a8792622c1676e9c1dddcf6807bfdde0911d8b2a6de39e7f068e4ba42add0b5c99ce795b4c29a9cbad459652b19aa8e04fa4e01f385678f93f66a9
-
SSDEEP
6144:ZZO4pwWLtkBtcD4oCGjN4eZAG+aObnXXX:HOcZ0c9otb
Static task
static1
Behavioral task
behavioral1
Sample
99eee6816b1dbbb80cbb5082d2c82414_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
99eee6816b1dbbb80cbb5082d2c82414_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
99eee6816b1dbbb80cbb5082d2c82414_JaffaCakes118
-
Size
232KB
-
MD5
99eee6816b1dbbb80cbb5082d2c82414
-
SHA1
cdbbc3d5d09d481038096c24a24a8d48c33e0adc
-
SHA256
fb51a8c32c9ab73b839799473f21113702599eb2708cedf5e5b3cf1e4a1824a2
-
SHA512
6cda429229a8792622c1676e9c1dddcf6807bfdde0911d8b2a6de39e7f068e4ba42add0b5c99ce795b4c29a9cbad459652b19aa8e04fa4e01f385678f93f66a9
-
SSDEEP
6144:ZZO4pwWLtkBtcD4oCGjN4eZAG+aObnXXX:HOcZ0c9otb
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-