Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    68388c581c7c4da2b334c5ab841d4baa_JaffaCakes118

  • Size

    544KB

  • Sample

    240723-tb8n1sxgpr

  • MD5

    68388c581c7c4da2b334c5ab841d4baa

  • SHA1

    97f643f8dc8336a7558d2dab80c6a5cf49960446

  • SHA256

    8ba4329b579a3ab8493caca37bbffcbbd0094475b0dc77560663f0b7f8da0bca

  • SHA512

    5ab84dada00867622a2137a398c29b21195d92b342821699a1b1b3c3a1fb3fb111726ff554112b6e840537d46dea24c786640464218ec989c6ff4eed5de9ccb4

  • SSDEEP

    12288:jQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:jQI+cJHiJRTHnxhUqEhe9suB2C8O9O

Malware Config

Targets

    • Target

      68388c581c7c4da2b334c5ab841d4baa_JaffaCakes118

    • Size

      544KB

    • MD5

      68388c581c7c4da2b334c5ab841d4baa

    • SHA1

      97f643f8dc8336a7558d2dab80c6a5cf49960446

    • SHA256

      8ba4329b579a3ab8493caca37bbffcbbd0094475b0dc77560663f0b7f8da0bca

    • SHA512

      5ab84dada00867622a2137a398c29b21195d92b342821699a1b1b3c3a1fb3fb111726ff554112b6e840537d46dea24c786640464218ec989c6ff4eed5de9ccb4

    • SSDEEP

      12288:jQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:jQI+cJHiJRTHnxhUqEhe9suB2C8O9O

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks