Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    49532b685eb4830725f4971b0dc143c9_JaffaCakes118

  • Size

    8.8MB

  • Sample

    240715-l5tsystenh

  • MD5

    49532b685eb4830725f4971b0dc143c9

  • SHA1

    878a6da04fa6f7ca5811d490dd4d7ca35e50e83e

  • SHA256

    bb93765c178972e6369ed74a26086e65d3ef81277fb795d101b776a5777bd30a

  • SHA512

    7ea726e93606968f2686fd3828d53113bd9333d58bf529176e7c7c461997596795632f75f2bf7ba60a20714346b014fd8c461c1be65b7fb0d28a4092e3f40a2c

  • SSDEEP

    196608:i7effIPEsy58doQaTzwZ8Jq3ELhf8cHpLG8doQpu8rVtxQul4ByDq3BAryfEQuQ0:i7effIPEsy58doQaTzwZ8Jq3ELhf8cHl

Malware Config

Targets

    • Target

      49532b685eb4830725f4971b0dc143c9_JaffaCakes118

    • Size

      8.8MB

    • MD5

      49532b685eb4830725f4971b0dc143c9

    • SHA1

      878a6da04fa6f7ca5811d490dd4d7ca35e50e83e

    • SHA256

      bb93765c178972e6369ed74a26086e65d3ef81277fb795d101b776a5777bd30a

    • SHA512

      7ea726e93606968f2686fd3828d53113bd9333d58bf529176e7c7c461997596795632f75f2bf7ba60a20714346b014fd8c461c1be65b7fb0d28a4092e3f40a2c

    • SSDEEP

      196608:i7effIPEsy58doQaTzwZ8Jq3ELhf8cHpLG8doQpu8rVtxQul4ByDq3BAryfEQuQ0:i7effIPEsy58doQaTzwZ8Jq3ELhf8cHl

    • Modifies WinLogon for persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks