Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5e6b6a20d0...18.exe

windows7-x64

10

5e6b6a20d0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e6b6a20d040922e798e3f318c39884e_JaffaCakes118

  • Size

    459KB

  • Sample

    240720-bcf2aayglr

  • MD5

    5e6b6a20d040922e798e3f318c39884e

  • SHA1

    c44dd1ea7e4733e1087ff8b4645c10a19fb1f788

  • SHA256

    3c5f4ff9125a06d4d71b66549abcf769a045140c3d8ce43684295c21225277e4

  • SHA512

    fed8e286b532a8690bb9fb06bf3f9326095dea62e679437e46d4c64e5ca9bb3e8c04fbd1092f83ae46b64ba52cc294398ea627c0bd5ebe7d91341e8c0acb9149

  • SSDEEP

    6144:q3Jn75HovZRFG5RryDoSOxrbkm3tTQl35x/pnt1ImPhuAFzsGc3Sk6pQQKN8Q2ZN:eIxneZnx53aN5nPEApcje9KWvl

Score
10/10
bootkitpersistence

Malware Config

Targets

    • Target

      5e6b6a20d040922e798e3f318c39884e_JaffaCakes118

    • Size

      459KB

    • MD5

      5e6b6a20d040922e798e3f318c39884e

    • SHA1

      c44dd1ea7e4733e1087ff8b4645c10a19fb1f788

    • SHA256

      3c5f4ff9125a06d4d71b66549abcf769a045140c3d8ce43684295c21225277e4

    • SHA512

      fed8e286b532a8690bb9fb06bf3f9326095dea62e679437e46d4c64e5ca9bb3e8c04fbd1092f83ae46b64ba52cc294398ea627c0bd5ebe7d91341e8c0acb9149

    • SSDEEP

      6144:q3Jn75HovZRFG5RryDoSOxrbkm3tTQl35x/pnt1ImPhuAFzsGc3Sk6pQQKN8Q2ZN:eIxneZnx53aN5nPEApcje9KWvl

    Score
    10/10
    bootkitpersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks