Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3cf12798c3...18.exe

windows7-x64

7

3cf12798c3...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cf12798c3df358f313d2be661228d6c_JaffaCakes118

  • Size

    350KB

  • Sample

    240712-l6fbysyfjk

  • MD5

    3cf12798c3df358f313d2be661228d6c

  • SHA1

    d0a4b021699c965d540fd4f0f0e3169b531c2df1

  • SHA256

    1c74ccb070bd075ec8bed834851134d9afc78f7e0872ddb1f075349bb3867fdb

  • SHA512

    dff94cb008435995fe05a6a9361ca7d94eb7a7c2282b996b6b88c9c57c3a6a3557fe8c6475da27b89c420cd86ac345bdb7bb76640dba0e6d99b8c990a082de6d

  • SSDEEP

    6144:qQqOqkiNtRRJli7NNV8i6A6SeDWAfNFAMIVpWHGVv3tbUT9zvrZnC:dqk4tRRK3yi6BSCRfNSMIymV1be9PZnC

Score
7/10
vmprotect

Malware Config

Targets

    • Target

      3cf12798c3df358f313d2be661228d6c_JaffaCakes118

    • Size

      350KB

    • MD5

      3cf12798c3df358f313d2be661228d6c

    • SHA1

      d0a4b021699c965d540fd4f0f0e3169b531c2df1

    • SHA256

      1c74ccb070bd075ec8bed834851134d9afc78f7e0872ddb1f075349bb3867fdb

    • SHA512

      dff94cb008435995fe05a6a9361ca7d94eb7a7c2282b996b6b88c9c57c3a6a3557fe8c6475da27b89c420cd86ac345bdb7bb76640dba0e6d99b8c990a082de6d

    • SSDEEP

      6144:qQqOqkiNtRRJli7NNV8i6A6SeDWAfNFAMIVpWHGVv3tbUT9zvrZnC:dqk4tRRK3yi6BSCRfNSMIymV1be9PZnC

    Score
    7/10
    vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks