Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9f8a475abce8ee5d836319045b20b65d_JaffaCakes118
-
Size
3.9MB
-
Sample
240611-z3rsgasand
-
MD5
9f8a475abce8ee5d836319045b20b65d
-
SHA1
89eeee314fd0f4a1bb48a24ed37cb985897660f3
-
SHA256
807457fd6828a6c089bfe1808dd9b21c3820fad6e54e18b517cb0bbd38abc42a
-
SHA512
1f4426cbd2b441e9ae1e1c0f473a97a71b8d1a4eac47743a26c2d7fa64441e59aeb5d9c88c9362a0a7f63a11ffd2a2713f2a3818ce46af3982df3289051f720c
-
SSDEEP
98304:IzkDz5Z5gxwn2hPMW35eQ7Cr56fWHd2JID4VV2iwbZ:+kDb5gaOj35u6fWHd2JIqV5QZ
Static task
static1
Behavioral task
behavioral1
Sample
9f8a475abce8ee5d836319045b20b65d_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
9f8a475abce8ee5d836319045b20b65d_JaffaCakes118
-
Size
3.9MB
-
MD5
9f8a475abce8ee5d836319045b20b65d
-
SHA1
89eeee314fd0f4a1bb48a24ed37cb985897660f3
-
SHA256
807457fd6828a6c089bfe1808dd9b21c3820fad6e54e18b517cb0bbd38abc42a
-
SHA512
1f4426cbd2b441e9ae1e1c0f473a97a71b8d1a4eac47743a26c2d7fa64441e59aeb5d9c88c9362a0a7f63a11ffd2a2713f2a3818ce46af3982df3289051f720c
-
SSDEEP
98304:IzkDz5Z5gxwn2hPMW35eQ7Cr56fWHd2JID4VV2iwbZ:+kDb5gaOj35u6fWHd2JIqV5QZ
-
Glupteba payload
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1