Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3d560e3271...18.exe

windows7-x64

7

3d560e3271...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d560e3271c9b7e8e5404154d4d2cb1e_JaffaCakes118

  • Size

    191KB

  • Sample

    240712-peqv6ashll

  • MD5

    3d560e3271c9b7e8e5404154d4d2cb1e

  • SHA1

    75de2faacb6ee1e804b3a8ea50f2f3cb1333a12c

  • SHA256

    b72368289f87a14f0a0dd8f8ba98cf42be5d1db97ef782f3761a5230e08e2627

  • SHA512

    965ea34d28fc55d771d52ff27c12fc0d90ab156c687e3778f190eb066663737054e83612092039568204f2fea7b3b0db245f8838b44473900b7758f5ededbbd8

  • SSDEEP

    3072:deQAZDNDRYtU4knKuVjXynbSckD0IMOGkHl+ESkV3dpD/6X0:de/ZDNOkAOsIhgjkRTiX0

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      3d560e3271c9b7e8e5404154d4d2cb1e_JaffaCakes118

    • Size

      191KB

    • MD5

      3d560e3271c9b7e8e5404154d4d2cb1e

    • SHA1

      75de2faacb6ee1e804b3a8ea50f2f3cb1333a12c

    • SHA256

      b72368289f87a14f0a0dd8f8ba98cf42be5d1db97ef782f3761a5230e08e2627

    • SHA512

      965ea34d28fc55d771d52ff27c12fc0d90ab156c687e3778f190eb066663737054e83612092039568204f2fea7b3b0db245f8838b44473900b7758f5ededbbd8

    • SSDEEP

      3072:deQAZDNDRYtU4knKuVjXynbSckD0IMOGkHl+ESkV3dpD/6X0:de/ZDNOkAOsIhgjkRTiX0

    Score
    7/10
    persistencespywarestealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks