Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

4a1a03c1bd...18.exe

windows7-x64

7

4a1a03c1bd...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a1a03c1bdacc608737ea07d42074a21_JaffaCakes118

  • Size

    135KB

  • Sample

    240715-r1k8xaybne

  • MD5

    4a1a03c1bdacc608737ea07d42074a21

  • SHA1

    f3da56d54a547f8ea19507191505c7c328814106

  • SHA256

    9f7573de2d65164fba85fa74c1b3a58d223fe4f70afe3c964a99f766405ae324

  • SHA512

    625b1b2e483d4955fd275118924d4f38c682cdbe9246b5291a6e506fe37f0be6f4463ce78374238d8f3a1a5ff1a2c2b6925a256066e312f56c128117d1423c14

  • SSDEEP

    3072:IW41XL2ip4kZWAgDfqzxaGmO5doJFhcI0wrzOIbfMSdML:IW4NLb4kZhgDMWOuP0CzO+UyML

Score
7/10
persistencespywarestealerupx

Malware Config

Targets

    • Target

      4a1a03c1bdacc608737ea07d42074a21_JaffaCakes118

    • Size

      135KB

    • MD5

      4a1a03c1bdacc608737ea07d42074a21

    • SHA1

      f3da56d54a547f8ea19507191505c7c328814106

    • SHA256

      9f7573de2d65164fba85fa74c1b3a58d223fe4f70afe3c964a99f766405ae324

    • SHA512

      625b1b2e483d4955fd275118924d4f38c682cdbe9246b5291a6e506fe37f0be6f4463ce78374238d8f3a1a5ff1a2c2b6925a256066e312f56c128117d1423c14

    • SSDEEP

      3072:IW41XL2ip4kZWAgDfqzxaGmO5doJFhcI0wrzOIbfMSdML:IW4NLb4kZhgDMWOuP0CzO+UyML

    Score
    7/10
    persistencespywarestealerupx

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks