Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

6a75b4bed7...18.exe

windows7-x64

7

6a75b4bed7...18.exe

windows10-2004-x64

7

$PLUGINSDI...am.dll

windows7-x64

3

$PLUGINSDI...am.dll

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ew.dll

windows7-x64

3

$PLUGINSDI...ew.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ta.dll

windows7-x64

3

$PLUGINSDI...ta.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...gr.dll

windows7-x64

3

$PLUGINSDI...gr.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDIR/stack.dll

windows7-x64

3

$PLUGINSDIR/stack.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

PCAutoUpdate.exe

windows7-x64

3

PCAutoUpdate.exe

windows10-2004-x64

3

PCClearSophos.exe

windows7-x64

3

PCClearSophos.exe

windows10-2004-x64

7

PCEngine.dll

windows7-x64

3

PCEngine.dll

windows10-2004-x64

3

etc/PCreport.exe

windows7-x64

7

etc/PCreport.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a75b4bed748294856051735cfe2cfcf_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240724-gjjnmstgjh

  • MD5

    6a75b4bed748294856051735cfe2cfcf

  • SHA1

    1067d9e569618c827abb34a7ddb6742f72e937a1

  • SHA256

    c1b9b1cf79fe82dc05c78d722eb15b11838825289785917ab040e53933b937f0

  • SHA512

    f016d9c9fa41e67c0c6080a4437a04426646b6354915b559616bc66b32d01e7fafade145de59e58c7b6b6b00dcb4fb0d9b0ec602823088cdcfbc36aa166ec0ea

  • SSDEEP

    24576:F8c3qcSKNn1oJ62UAgwBSCOqS3gSdcFlgYX3Mgs/y0h3qOI+vKktDRbzLfK92VVq:EIR1oJ62b7BSCSQ9lR35X0Bao9K2V

Score
7/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      6a75b4bed748294856051735cfe2cfcf_JaffaCakes118

    • Size

      1.8MB

    • MD5

      6a75b4bed748294856051735cfe2cfcf

    • SHA1

      1067d9e569618c827abb34a7ddb6742f72e937a1

    • SHA256

      c1b9b1cf79fe82dc05c78d722eb15b11838825289785917ab040e53933b937f0

    • SHA512

      f016d9c9fa41e67c0c6080a4437a04426646b6354915b559616bc66b32d01e7fafade145de59e58c7b6b6b00dcb4fb0d9b0ec602823088cdcfbc36aa166ec0ea

    • SSDEEP

      24576:F8c3qcSKNn1oJ62UAgwBSCOqS3gSdcFlgYX3Mgs/y0h3qOI+vKktDRbzLfK92VVq:EIR1oJ62b7BSCSQ9lR35X0Bao9K2V

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DLLWaitForKillProgram.dll

    • Size

      28KB

    • MD5

      9c4b8ec42d89f7557bfd90798ce52787

    • SHA1

      2376dde426ea65aa27c30e304086310605382475

    • SHA256

      ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

    • SHA512

      17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

    • SSDEEP

      96:EP5ZuFye0MyQW4uPwhs+R/+gFrE1m/U/uG98bp2y+HS21kEZ1b+4Tu9C1uGg8wBu:akFyFRQ5wIzlH/UGq36EZY4T+Gul8U

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/DLLWebCount.dll

    • Size

      28KB

    • MD5

      0bdd7c6f1046ea4b42839f991ae53fb2

    • SHA1

      cb9baefb10159b4a684fa1ee4372e7715865052d

    • SHA256

      0a0019b2603dbc4505453c2501255ab0cc0b3c317ece4a6ce0cfb6a02a30907b

    • SHA512

      96f41497f25d7bc81f51ab167f74243b4b767089c89c26f9752ef518fa60dedd2722c66ae87dad2334bcce1622bc12f7b9b892ae654ca58cecd9f35c9f1dc163

    • SSDEEP

      192:OQoR7CK9FX/dVPWtJ/tXP88bSNwWW8+YdbDT:OQcWeJ/XPWtJxPFYi8nb

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/DLLWebCount_new.dll

    • Size

      28KB

    • MD5

      f16f5feebd9b431a8bc63456c0ad267c

    • SHA1

      acc75cfa3ed7888334aa2ccf305a6c6c58a08aaf

    • SHA256

      5417af0fc8284e9745650a55803bb34217e314096dc7cedf113c960624ae08ad

    • SHA512

      ed1e62d903b511a29abd5def4419b5afa63699ee2d1c91a9d884ffb01d7debe5981559574cac4885140d1f27f4275be56236f5c6f1c327147dcac8893f965512

    • SSDEEP

      96:3YP18J49uJPeaFX/0gOtJ/9nMjbnbk2Zl1bU6i9vtmAuSBudGaTA:3f1bFX/rOtJ/lMvbfJU6snpYdb

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/IEFunctions.dll

    • Size

      3KB

    • MD5

      9701818d39318145dd164794ef3a3846

    • SHA1

      7db701f8dc19163d46ba88e8b68d8dbf428a8152

    • SHA256

      3122b0413f74e88518cfd1b9c6e18435dd326ca177a2374b6405df78f43e776a

    • SHA512

      d92786630250e9eb6c47537b09684fa107f959b50d255c7f3952741eb438c3be47e171827d3a4407b049c33c12dad73f8ec381a7265b28a6d8ca101ff702e8a4

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      eef9e469e8a30717974499f277d97e2a

    • SHA1

      2d33c25984ebd9116beeb55cdde4c5c86c023e5d

    • SHA256

      1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078

    • SHA512

      d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48

    • SSDEEP

      192:8np6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTjK72dwF7dBEnbok:8p6UdHXcIiY535zBtMTj+BEnbo

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/IsVista.dll

    • Size

      44KB

    • MD5

      344d13fd0fdd2d97e8d61960f40a8a30

    • SHA1

      3f0f120203005eea3e8ed1652a6ea8a607ea934d

    • SHA256

      17bb3331e2300aa01666fbee98b9552cec5e46212a4c5a340c0370b93df88f83

    • SHA512

      b4e49c58503532e270cc369f1cbd14d85edd46da5ab034dad730bd4297887dd541d445d2fbf205820e6afbbdba7ab6d5b78b694467554320fd6db8e06fe4f719

    • SSDEEP

      384:x4MHyTfkIbqaddF1qabhJfl7Tisz7c7t3TyAvdjWu875USXdvlHZYklIsg:FSTpbqaLfHJflCszOTbdjWR3Nvl

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      36KB

    • MD5

      6958016193a066833556992077bad4fe

    • SHA1

      5f564945936f99381d7e2408f034f97d069005a4

    • SHA256

      f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

    • SHA512

      fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

    • SSDEEP

      384:IL6T2Izs/XGCanZSwEfj5lwTSYlml89oayKA15JiQNRw/9uosAUdJofiiqd:88Y9gZSwq1lwTS2XA15DRm9cddJo6l

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/UserMgr.dll

    • Size

      55KB

    • MD5

      130f66c0161e6da46744abe3c0be4d9c

    • SHA1

      d2a44a0cd07bc0c5d81fc0d056d6d45d200896ed

    • SHA256

      955705c8c7188d06af16849e5cc3ceae79ea5d0808cc2851630a54d54bbc01f2

    • SHA512

      915b9135da230ec8d3016ba83bd7102b3f8cb13050189a176f8d4d50363f13584fb971226458bc493cd2df27723c8ab7273effab7d6c6e14d49e735d24d7fac8

    • SSDEEP

      768:fThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lV:7SCQeLCHpCyNV9ZTRbkuOQzyMVt/blV

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      cdff6b8f9523b6ef9f20fb5f9e90f1a5

    • SHA1

      b25f6e0a19b41ff0a12de8e98e3005bc119d34fa

    • SHA256

      80b2740fb3a21ffab022a96ce6b420019072f8ef3a048fd9dea4a5b64498c0c8

    • SHA512

      62585c6a6103aed10f9a79c016df8cb630c3e37715542b5f26aa1a910771540c9b323ddbba3329db0ecf524143f7a27b782e198ce944317f764be6b9d04b792e

    • SSDEEP

      96:W7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3trCUTMxVXw32E:IKgfwgcr8zylsB49lrCUTMxVX7

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/stack.dll

    • Size

      10KB

    • MD5

      0f61a81a543822de5fcb9a8a43f230dd

    • SHA1

      d01d4a0f542f3c654637fdfe5a574fe1f150ece1

    • SHA256

      46b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f

    • SHA512

      596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402

    • SSDEEP

      192:VBEc/BwQV5gTRk6uIu8uQubQuNu3fufuXuPDyuSuFujournu6udkuUuw0y9UrVo:VBEwBZmx97TSefeC/zIqoInvEkJ8y9x

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/xml.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      PCAutoUpdate.exe

    • Size

      452KB

    • MD5

      890fba6b0654b42c537df689ea243cf1

    • SHA1

      453b7374e997bef4a12608be928c4c14a12bdf49

    • SHA256

      3d754175751dc5d6b0f187e964209bc32e968252e40899179c8b5ee7f5b99980

    • SHA512

      eaa936dd8f50f057145b897332227665053d83b09191789c26c5b6aac46c45247f90094f27cae7afbd060d07cfbe956f9034527537aba68963259402d67cd04c

    • SSDEEP

      12288:tRgroMEIcaXMSB0X4549ppvU9kUWI7xRnHn7:8rRExRXVpSWI7znH7

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      PCClearSophos.exe

    • Size

      776KB

    • MD5

      64734f8bad63f2bc9dd152eb1acec48b

    • SHA1

      573233bd4b4efd3e915a7173252840676783838e

    • SHA256

      cf663da5d2062f50e14fcce76903a0bc3de65e5722c41f31f62d09b9d592b5cc

    • SHA512

      87049d5c4da7c90503115fd22fc669e8d9a866174653419608bf5277edeec632fe42617adb14d244c3518e1d455660e4f63209d26725cc5cff65fb1c7d821fa1

    • SSDEEP

      12288:iBtcyc6rLxfTcWTqu7NqDzVOZCeRlG4WFJQjsEqPrCxUBkTl6mqOZWYrsN3:Cg6rLxYWinUZCeRlG4WXTCxUBkVqv7

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral27behavioral28

    • Target

      PCEngine.dll

    • Size

      652KB

    • MD5

      cb4bad5002759e34c4924d4fc0159ae5

    • SHA1

      2407f9a4f9cec169177a6cc91dac07f752a367ec

    • SHA256

      ce095ed27f604242e502db6b6a25657f16df7652571b8ae6301629da19522345

    • SHA512

      f57f97068e5029b01a7094f030578b7188cdd0c450d25f69460baf2382054b84509b3a2e53f098e59a9b0bd57a5b94f553a17dcbda6221a68ab6475df5c2d2d8

    • SSDEEP

      12288:twB8DjmDi5gebVEDh30uA7ZCq7lG4hRD9zHjjgXLNWlSOlFXrR9:twB8DKi5gebVA1LA7ZCq7lG4hRD6NWld

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      etc/PCreport.exe

    • Size

      288KB

    • MD5

      f9e6db32fc346fa8f324ff8182715253

    • SHA1

      1a08b274af2f99cb5e8924029a01e1de99d9ef36

    • SHA256

      d278c63fcc4b5b85536c8fab44e6644e6fb7643ed4bd6e04fc28b361647d7ee5

    • SHA512

      1af9da0d11fd050642e5f7cf2b21b3ff6de029338d682abcf9baf9d7eeae0d905c7b99281fb02a352b0b1248619773d6eb7d8602f5db966b70a6864b9464c126

    • SSDEEP

      3072:zhBx/XAz2J5RivMaE7CDNGQrsPp3iPuOZNX7LMLg7KR17aFo8Dg85:NvQ85R01w3ouOZNX7LMLgUVa

    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
7/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discoveryspywarestealer
Score
7/10

behavioral32

discoveryspywarestealer
Score
7/10