Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
40307292696d859f8d3a97df311a9d2f_JaffaCakes118
-
Size
1.2MB
-
Sample
240713-e18yrawamm
-
MD5
40307292696d859f8d3a97df311a9d2f
-
SHA1
d64c5e58bd28e8e07129f6dd9e0f14f3bab6bc4e
-
SHA256
09bacffe4de984d8cb29d13fc6b0628c9412b43c53d05c8b02426f6ff7cc2cf8
-
SHA512
94b3b2fd989f64be90af72d1999550a444656639e183ec3d399a88da65bf3a75603e28d7e315204db698e60fe31cf68b907599eed153d38e2a15e04133f36a90
-
SSDEEP
1536:APA+WLx+eu/pEhrUBZjnY2GJBofIxGDpykBZpiGnouy8:AI+mgC2p2ifINp2out
Behavioral task
behavioral1
Sample
40307292696d859f8d3a97df311a9d2f_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
40307292696d859f8d3a97df311a9d2f_JaffaCakes118
-
Size
1.2MB
-
MD5
40307292696d859f8d3a97df311a9d2f
-
SHA1
d64c5e58bd28e8e07129f6dd9e0f14f3bab6bc4e
-
SHA256
09bacffe4de984d8cb29d13fc6b0628c9412b43c53d05c8b02426f6ff7cc2cf8
-
SHA512
94b3b2fd989f64be90af72d1999550a444656639e183ec3d399a88da65bf3a75603e28d7e315204db698e60fe31cf68b907599eed153d38e2a15e04133f36a90
-
SSDEEP
1536:APA+WLx+eu/pEhrUBZjnY2GJBofIxGDpykBZpiGnouy8:AI+mgC2p2ifINp2out
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1