Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118
-
Size
808KB
-
Sample
240712-p2q5faweqe
-
MD5
3d71e631c6d0c0be9b43a58fdd0a0b0f
-
SHA1
84975f32c155ae4f0429732610e79bfa0dfe22b4
-
SHA256
70ef9ecadb6950c33637b0aa98fdac2a9cb700e7a7c103efaddba6d8a96bca36
-
SHA512
ff49bd9441b68bfb0d4c76d9dffe46a0ce1b98af133bef34c8dff2358338a0c66b1401cf07d7504d8990f9912cf4829b9c269f8868a387ab29a055da71ff58f0
-
SSDEEP
12288:GcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:Gc2+ms5pavs+NpM9nXg79CU
Static task
static1
Behavioral task
behavioral1
Sample
3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118
-
Size
808KB
-
MD5
3d71e631c6d0c0be9b43a58fdd0a0b0f
-
SHA1
84975f32c155ae4f0429732610e79bfa0dfe22b4
-
SHA256
70ef9ecadb6950c33637b0aa98fdac2a9cb700e7a7c103efaddba6d8a96bca36
-
SHA512
ff49bd9441b68bfb0d4c76d9dffe46a0ce1b98af133bef34c8dff2358338a0c66b1401cf07d7504d8990f9912cf4829b9c269f8868a387ab29a055da71ff58f0
-
SSDEEP
12288:GcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:Gc2+ms5pavs+NpM9nXg79CU
-
Modifies WinLogon for persistence
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
7