Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b453a3611e3e34166f90e0d8b07f3db3_JaffaCakes118

  • Size

    512KB

  • Sample

    240616-tbee6syhph

  • MD5

    b453a3611e3e34166f90e0d8b07f3db3

  • SHA1

    a89dafff7bdcd5d1b0a26326d4c62d2fa2715a77

  • SHA256

    753d25a1bad0f519f87116ad81b27d47ec7d180923b7b35849acbc7a888d5b5d

  • SHA512

    bdc7e26da3d40c32d74ec5ae3a7eda5bcedc48bfe2265d243a4e578087aa03cd3f4fa4e1948024f980f49c692031c9f5d0961a0951956fd01fd9473cf1d884e3

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N

Malware Config

Targets

    • Target

      b453a3611e3e34166f90e0d8b07f3db3_JaffaCakes118

    • Size

      512KB

    • MD5

      b453a3611e3e34166f90e0d8b07f3db3

    • SHA1

      a89dafff7bdcd5d1b0a26326d4c62d2fa2715a77

    • SHA256

      753d25a1bad0f519f87116ad81b27d47ec7d180923b7b35849acbc7a888d5b5d

    • SHA512

      bdc7e26da3d40c32d74ec5ae3a7eda5bcedc48bfe2265d243a4e578087aa03cd3f4fa4e1948024f980f49c692031c9f5d0961a0951956fd01fd9473cf1d884e3

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks