Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6585f4bb6affc9cbafd941e260322759_JaffaCakes118
-
Size
1.8MB
-
Sample
240723-bcjgeaybqb
-
MD5
6585f4bb6affc9cbafd941e260322759
-
SHA1
039773d81b787cd56eaf831503330f21299d1f6f
-
SHA256
b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
-
SHA512
3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d
-
SSDEEP
49152:If7xgiTYZbruT5Koqf8Dm98YJiJcyWnMlo:gY3uVxT1Y0JzWM+
Static task
static1
Behavioral task
behavioral1
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
http://galaint.onlinesecstats.info/?0=127&1=0&2=1&3=60&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=pnsotxnksp&14=1
Targets
-
-
Target
6585f4bb6affc9cbafd941e260322759_JaffaCakes118
-
Size
1.8MB
-
MD5
6585f4bb6affc9cbafd941e260322759
-
SHA1
039773d81b787cd56eaf831503330f21299d1f6f
-
SHA256
b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
-
SHA512
3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d
-
SSDEEP
49152:If7xgiTYZbruT5Koqf8Dm98YJiJcyWnMlo:gY3uVxT1Y0JzWM+
Score10/10-
Disables taskbar notifications via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1