Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5c9e80f700...18.exe

windows7-x64

10

5c9e80f700...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240719-tc2bbsscqh

  • MD5

    5c9e80f700149dc90e32d5fe0a99344a

  • SHA1

    ad02b83ad81de9cc40519a63b9301df79166ecc4

  • SHA256

    5376988888b8910a07fcbf46369e88e20ebf07aa0448fc3e0bbc5724f33490d6

  • SHA512

    f0c5b2ad05bc46f873893a2532a631be819dc5441699dec16e62f512f2a693b42d2752b743869f266821c014a9c10fad7fb6bd463816d4a9b089f99478867e85

  • SSDEEP

    3072:ThzV9Rd1gWIoKMHOlQtjZtIax1I5NJK5cBnyypQ1x2Cmswz:dRbOCtjvQJFfKxms

Score
10/10
evasionexecutionpersistence

Malware Config

Targets

    • Target

      5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118

    • Size

      1.6MB

    • MD5

      5c9e80f700149dc90e32d5fe0a99344a

    • SHA1

      ad02b83ad81de9cc40519a63b9301df79166ecc4

    • SHA256

      5376988888b8910a07fcbf46369e88e20ebf07aa0448fc3e0bbc5724f33490d6

    • SHA512

      f0c5b2ad05bc46f873893a2532a631be819dc5441699dec16e62f512f2a693b42d2752b743869f266821c014a9c10fad7fb6bd463816d4a9b089f99478867e85

    • SSDEEP

      3072:ThzV9Rd1gWIoKMHOlQtjZtIax1I5NJK5cBnyypQ1x2Cmswz:dRbOCtjvQJFfKxms

    Score
    10/10
    evasionexecutionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Drops file in Drivers directory

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks