Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
620cd11be41a53d45294ccb994ebf592_JaffaCakes118
-
Size
398KB
-
Sample
240722-as7cqsseka
-
MD5
620cd11be41a53d45294ccb994ebf592
-
SHA1
c3cefe0d6dbe9a50217ddc9ff17f2ac3c352bb6e
-
SHA256
69517a29cf516f8e51d6d911f34d6f8ad30540a922cc444fcdc3222a508d0227
-
SHA512
06596e5253780cce6aa73adb8a4ecb19a3a68bda3153738051d239761c6abe8fa9994dfdbc207c4e02ba0c074f17d86de2726decbf8e794fedf4ac6e41809d0d
-
SSDEEP
12288:l20u6pOnFZrDRMLMjegAF7rmvgLsF11VsC/I:l207puLDd6gY7rmvZf5/I
Static task
static1
Behavioral task
behavioral1
Sample
620cd11be41a53d45294ccb994ebf592_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
620cd11be41a53d45294ccb994ebf592_JaffaCakes118
-
Size
398KB
-
MD5
620cd11be41a53d45294ccb994ebf592
-
SHA1
c3cefe0d6dbe9a50217ddc9ff17f2ac3c352bb6e
-
SHA256
69517a29cf516f8e51d6d911f34d6f8ad30540a922cc444fcdc3222a508d0227
-
SHA512
06596e5253780cce6aa73adb8a4ecb19a3a68bda3153738051d239761c6abe8fa9994dfdbc207c4e02ba0c074f17d86de2726decbf8e794fedf4ac6e41809d0d
-
SSDEEP
12288:l20u6pOnFZrDRMLMjegAF7rmvgLsF11VsC/I:l207puLDd6gY7rmvZf5/I
-
Modifies firewall policy service
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5