Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

04e2cfbb7f...18.exe

windows7-x64

7

04e2cfbb7f...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04e2cfbb7f231d964afc25006ad4e5bf_JaffaCakes118

  • Size

    138KB

  • Sample

    240620-ltff7avfpn

  • MD5

    04e2cfbb7f231d964afc25006ad4e5bf

  • SHA1

    775b7bf3a30d3bdcc4e68f0cb29c2745ad97e21b

  • SHA256

    edfec48c5b9a18add8442f19cf8ecd8457af25a7251cb34fe2d20616dcf315ef

  • SHA512

    a87f700335722bd8900889eceb4f47f6f0309f6ab23de81dca7267e9253f6b0521d9472cb08a0bf1c52d3bca3f095efc0df2fb7533560853fa0da5f5cbd8a357

  • SSDEEP

    3072:qz71LZQEduEgsW2UPqxUEnqkC0i50/YXiQXT+t/8XIgfUTaXD3kz1QNS:qz71L+QHhUPqxUElQiQwkXhfUThQ4

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      04e2cfbb7f231d964afc25006ad4e5bf_JaffaCakes118

    • Size

      138KB

    • MD5

      04e2cfbb7f231d964afc25006ad4e5bf

    • SHA1

      775b7bf3a30d3bdcc4e68f0cb29c2745ad97e21b

    • SHA256

      edfec48c5b9a18add8442f19cf8ecd8457af25a7251cb34fe2d20616dcf315ef

    • SHA512

      a87f700335722bd8900889eceb4f47f6f0309f6ab23de81dca7267e9253f6b0521d9472cb08a0bf1c52d3bca3f095efc0df2fb7533560853fa0da5f5cbd8a357

    • SSDEEP

      3072:qz71LZQEduEgsW2UPqxUEnqkC0i50/YXiQXT+t/8XIgfUTaXD3kz1QNS:qz71L+QHhUPqxUElQiQwkXhfUThQ4

    Score
    7/10
    persistencespywarestealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks