Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4900842bba4e74fb20c432aeb289acee_JaffaCakes118
-
Size
744KB
-
Sample
240715-kd64jazflf
-
MD5
4900842bba4e74fb20c432aeb289acee
-
SHA1
c0faed52a4dbf94583959d552a7c0a65900a5468
-
SHA256
9d9a649a9bd1ab1a03920628aa9a3d0c0811766ad6d0c3e8f406370eb918c0c0
-
SHA512
70e6b9167572547ce552c49e00e851417783907da245aee38c421f811fe55b2c890bbeb147512e8d8bba44db87b1c3ea645d70a6a0309aabb69cc8233559daf6
-
SSDEEP
12288:Yz+hvz7spbME8rgLGUbx3YgYU+1ImJ9j5rZeeMMlxE+ge8rWjr3NnGii6YT37lHm:i+hvXwME8rbUbF9t+1dQMcWns6YflH5Q
Static task
static1
Behavioral task
behavioral1
Sample
4900842bba4e74fb20c432aeb289acee_JaffaCakes118.exe
Resource
win7-20240705-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
4900842bba4e74fb20c432aeb289acee_JaffaCakes118
-
Size
744KB
-
MD5
4900842bba4e74fb20c432aeb289acee
-
SHA1
c0faed52a4dbf94583959d552a7c0a65900a5468
-
SHA256
9d9a649a9bd1ab1a03920628aa9a3d0c0811766ad6d0c3e8f406370eb918c0c0
-
SHA512
70e6b9167572547ce552c49e00e851417783907da245aee38c421f811fe55b2c890bbeb147512e8d8bba44db87b1c3ea645d70a6a0309aabb69cc8233559daf6
-
SSDEEP
12288:Yz+hvz7spbME8rgLGUbx3YgYU+1ImJ9j5rZeeMMlxE+ge8rWjr3NnGii6YT37lHm:i+hvXwME8rbUbF9t+1dQMcWns6YflH5Q
-
Modifies firewall policy service
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6