Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
251b2aa8926837628d272632869a766d_JaffaCakes118
-
Size
100KB
-
Sample
240704-h8zltssfqa
-
MD5
251b2aa8926837628d272632869a766d
-
SHA1
653065209a850cf2e1ef2f233e32f0ad61ec7cb2
-
SHA256
2cec5f4dbc2f81cc3e0f13ebadae9676c7132ed5f46a46997e17981c36434c64
-
SHA512
e4842286a80659ebfde4f2b63aa938df12513efc115e6265d06f50ae8ddc17b1bbce1196d244a248af653f0952069f7d705a19c7403b0894672b6473ac625c5c
-
SSDEEP
1536:G1BeYZWsfxN4DmoPUhuhA6g+JOpHB4vmixqVb1mJgXBXhICgJPw:MBZTfJoPCDpHBedI1mSXw/I
Static task
static1
Behavioral task
behavioral1
Sample
251b2aa8926837628d272632869a766d_JaffaCakes118.exe
Resource
win7-20231129-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
251b2aa8926837628d272632869a766d_JaffaCakes118
-
Size
100KB
-
MD5
251b2aa8926837628d272632869a766d
-
SHA1
653065209a850cf2e1ef2f233e32f0ad61ec7cb2
-
SHA256
2cec5f4dbc2f81cc3e0f13ebadae9676c7132ed5f46a46997e17981c36434c64
-
SHA512
e4842286a80659ebfde4f2b63aa938df12513efc115e6265d06f50ae8ddc17b1bbce1196d244a248af653f0952069f7d705a19c7403b0894672b6473ac625c5c
-
SSDEEP
1536:G1BeYZWsfxN4DmoPUhuhA6g+JOpHB4vmixqVb1mJgXBXhICgJPw:MBZTfJoPCDpHBedI1mSXw/I
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5