Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6838e7456102a1e9ea00059205e42418_JaffaCakes118
-
Size
226KB
-
Sample
240723-tcjraaxgqq
-
MD5
6838e7456102a1e9ea00059205e42418
-
SHA1
5add4083a2ce784a22f5f543f9bb51d8da9a0fe6
-
SHA256
f642293be37b95c23bfc994a7eb76e35337e86a2315fe18a314d16623257b194
-
SHA512
0dc1740a0bca44ac776b0f84850bf74f6ad534913973c4fe80ce14b4ab72965a52d4b6b12d920f3851912c0336ed71111996df2d475fbf0064bdf59fcaaab855
-
SSDEEP
6144:FKsp/bS6Hjj08VRCnKpYQEQP2uCmD8BVoPKx1wjIik:FrxVH/0QP21mwvDx1bB
Static task
static1
Behavioral task
behavioral1
Sample
6838e7456102a1e9ea00059205e42418_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6838e7456102a1e9ea00059205e42418_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
6838e7456102a1e9ea00059205e42418_JaffaCakes118
-
Size
226KB
-
MD5
6838e7456102a1e9ea00059205e42418
-
SHA1
5add4083a2ce784a22f5f543f9bb51d8da9a0fe6
-
SHA256
f642293be37b95c23bfc994a7eb76e35337e86a2315fe18a314d16623257b194
-
SHA512
0dc1740a0bca44ac776b0f84850bf74f6ad534913973c4fe80ce14b4ab72965a52d4b6b12d920f3851912c0336ed71111996df2d475fbf0064bdf59fcaaab855
-
SSDEEP
6144:FKsp/bS6Hjj08VRCnKpYQEQP2uCmD8BVoPKx1wjIik:FrxVH/0QP21mwvDx1bB
Score10/10-
Modifies WinLogon for persistence
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
Modifies WinLogon
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2