Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118
-
Size
2.0MB
-
Sample
240619-zsp6ws1erc
-
MD5
0077c2fd7e98b372a973640ebdb67bb4
-
SHA1
687f3783243b3da71d0cb882318224df3406a11c
-
SHA256
b76b2e9356507b2d1c8157c0f885592d27e8dc9c8d95e6024e041d758d94d5a1
-
SHA512
5866d2e329e5e7aff9e306af17c9cf7ddf7a4f47eb42f3473470af7ffb57af2c6473c1062f645369f050cb7852017f0d3dfbdabf84064c0508f77a6778d9e9aa
-
SSDEEP
49152:DLqatPmogbmVZBTN1xC05KRkgc68WJI5NeGu5dkpFpERe8JjVwv14x4Q:DbmHb0f1CRNRJuIGu5mpFpERe8s1i
Static task
static1
Behavioral task
behavioral1
Sample
0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
http://galaint.coolsecupdate.info/?0=112&1=8&2=1&3=33&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hwktraryyo&14=1
Extracted
http://galaint.coolsecupdate.info/?0=112&1=8&2=1&3=33&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=vvibltkbjg&14=1
Targets
-
-
Target
0077c2fd7e98b372a973640ebdb67bb4_JaffaCakes118
-
Size
2.0MB
-
MD5
0077c2fd7e98b372a973640ebdb67bb4
-
SHA1
687f3783243b3da71d0cb882318224df3406a11c
-
SHA256
b76b2e9356507b2d1c8157c0f885592d27e8dc9c8d95e6024e041d758d94d5a1
-
SHA512
5866d2e329e5e7aff9e306af17c9cf7ddf7a4f47eb42f3473470af7ffb57af2c6473c1062f645369f050cb7852017f0d3dfbdabf84064c0508f77a6778d9e9aa
-
SSDEEP
49152:DLqatPmogbmVZBTN1xC05KRkgc68WJI5NeGu5dkpFpERe8JjVwv14x4Q:DbmHb0f1CRNRJuIGu5mpFpERe8s1i
Score10/10-
Disables taskbar notifications via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1