Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0e69332019dedab172af0308c3369158_JaffaCakes118
-
Size
9.0MB
-
Sample
240625-rrx64svflf
-
MD5
0e69332019dedab172af0308c3369158
-
SHA1
a34101c36db0d39eef34f4c80f2fac7578dd1379
-
SHA256
523efc41a3ca93b185f8308ddfdf6842901ff510af7cc4f8714e2ecca1e2ae15
-
SHA512
7e2436c2e49a7a5b6a1374885e6596e0fc0ab9c87536693af913bc975507d1e06524cba1ebbb16dd6a1ea6273836450f8ed78d6b7cd068c2e0e3f4cd9a03277d
-
SSDEEP
196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXlAryfEQu6JBfA:i7effIPEsy58doQaTxLhQyZbIly38doC
Behavioral task
behavioral1
Sample
0e69332019dedab172af0308c3369158_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0e69332019dedab172af0308c3369158_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
0e69332019dedab172af0308c3369158_JaffaCakes118
-
Size
9.0MB
-
MD5
0e69332019dedab172af0308c3369158
-
SHA1
a34101c36db0d39eef34f4c80f2fac7578dd1379
-
SHA256
523efc41a3ca93b185f8308ddfdf6842901ff510af7cc4f8714e2ecca1e2ae15
-
SHA512
7e2436c2e49a7a5b6a1374885e6596e0fc0ab9c87536693af913bc975507d1e06524cba1ebbb16dd6a1ea6273836450f8ed78d6b7cd068c2e0e3f4cd9a03277d
-
SSDEEP
196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXlAryfEQu6JBfA:i7effIPEsy58doQaTxLhQyZbIly38doC
Score10/10-
Modifies WinLogon for persistence
-
Drops file in Drivers directory
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2