Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    63938c2016661a3e1a4ada7867471fc5_JaffaCakes118

  • Size

    3.8MB

  • Sample

    240722-r2bqvssfkc

  • MD5

    63938c2016661a3e1a4ada7867471fc5

  • SHA1

    a4ad4a7888c9f334464cfc52f3bfba9b4c579989

  • SHA256

    8f47721cf4ff1da1a90b5b2e8e8904ce2a37a291b00f0d7e92c57815c11a8e35

  • SHA512

    3976430841342b580165ad0c54643f235a8868161df06101005440fe0807655b23b3c51571111f30f8fc903473a4c188e388aacebf125b2bdbe9568f449911da

  • SSDEEP

    98304:qs9swZu4J0M4h3izcpIQi8DQMjj+LUES59KpfBuXD03LshX:pOwZu4CyzZ2QMuoE8Mrbwh

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      63938c2016661a3e1a4ada7867471fc5_JaffaCakes118

    • Size

      3.8MB

    • MD5

      63938c2016661a3e1a4ada7867471fc5

    • SHA1

      a4ad4a7888c9f334464cfc52f3bfba9b4c579989

    • SHA256

      8f47721cf4ff1da1a90b5b2e8e8904ce2a37a291b00f0d7e92c57815c11a8e35

    • SHA512

      3976430841342b580165ad0c54643f235a8868161df06101005440fe0807655b23b3c51571111f30f8fc903473a4c188e388aacebf125b2bdbe9568f449911da

    • SSDEEP

      98304:qs9swZu4J0M4h3izcpIQi8DQMjj+LUES59KpfBuXD03LshX:pOwZu4CyzZ2QMuoE8Mrbwh

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.