Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

64e77fea76...18.exe

windows7-x64

8

64e77fea76...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64e77fea7691cb2b80e910c313d669a7_JaffaCakes118

  • Size

    241KB

  • Sample

    240722-1me96szgpn

  • MD5

    64e77fea7691cb2b80e910c313d669a7

  • SHA1

    578199a7e14949d7b7365f609075917099fab176

  • SHA256

    d260877865ebd1bba5e3ff96cf6da98dc7fd1e2f2bb915fdcc1c0b5ad79b303d

  • SHA512

    5058ed74b1acdfc987b2b8bd31e641affbbea5ea3b89cbf066d934e20d006d370bfddd2d489ed8a06ccd6bc3dbd51a1af1108529d468f4429873ffca02555c82

  • SSDEEP

    6144:8+NB/XILQ09WilJK4yz57r5Z/xYpIAlVp/eoqzEDJRXL:dr/YNl+Z/xYpxTvqY7

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      64e77fea7691cb2b80e910c313d669a7_JaffaCakes118

    • Size

      241KB

    • MD5

      64e77fea7691cb2b80e910c313d669a7

    • SHA1

      578199a7e14949d7b7365f609075917099fab176

    • SHA256

      d260877865ebd1bba5e3ff96cf6da98dc7fd1e2f2bb915fdcc1c0b5ad79b303d

    • SHA512

      5058ed74b1acdfc987b2b8bd31e641affbbea5ea3b89cbf066d934e20d006d370bfddd2d489ed8a06ccd6bc3dbd51a1af1108529d468f4429873ffca02555c82

    • SSDEEP

      6144:8+NB/XILQ09WilJK4yz57r5Z/xYpIAlVp/eoqzEDJRXL:dr/YNl+Z/xYpxTvqY7

    Score
    8/10
    persistenceupx

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks