Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

6afd9c0138...18.exe

windows7-x64

7

6afd9c0138...18.exe

windows10-2004-x64

7

$LOCALAPPD...ub.dll

windows7-x64

3

$LOCALAPPD...ub.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

RegistInstallCnt.exe

windows7-x64

3

RegistInstallCnt.exe

windows10-2004-x64

3

WinTool.exe

windows7-x64

3

WinTool.exe

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6afd9c0138821dfae71915f9e3011864_JaffaCakes118

  • Size

    210KB

  • Sample

    240724-kvc7sa1ajc

  • MD5

    6afd9c0138821dfae71915f9e3011864

  • SHA1

    20adc60e5bb551b2e56e3a6ecb061f40f62ed964

  • SHA256

    c8eff05ddf176ea6b12f5e973263f9eb2c5961300312873d328a18eb8995b504

  • SHA512

    6eba5505b5f1067df9b17ece16109d85809cde42dbc3b1cc8d038ac026455538eb69cc606fd079315b578c9f6a2f02f2fc19ca157f186012bbd9e5911acf9d56

  • SSDEEP

    3072:sgXdZt9P6D3XJR45bwA4n36s2tB+tpv2Yb5DaFOjDwHYOZF5V09sy24p7q0iK0sl:se34PePotb5ao3wVF5V0yAq0Qi

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      6afd9c0138821dfae71915f9e3011864_JaffaCakes118

    • Size

      210KB

    • MD5

      6afd9c0138821dfae71915f9e3011864

    • SHA1

      20adc60e5bb551b2e56e3a6ecb061f40f62ed964

    • SHA256

      c8eff05ddf176ea6b12f5e973263f9eb2c5961300312873d328a18eb8995b504

    • SHA512

      6eba5505b5f1067df9b17ece16109d85809cde42dbc3b1cc8d038ac026455538eb69cc606fd079315b578c9f6a2f02f2fc19ca157f186012bbd9e5911acf9d56

    • SSDEEP

      3072:sgXdZt9P6D3XJR45bwA4n36s2tB+tpv2Yb5DaFOjDwHYOZF5V09sy24p7q0iK0sl:se34PePotb5ao3wVF5V0yAq0Qi

    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $LOCALAPPDATA/WinTool/WinToolSub.dll

    • Size

      252KB

    • MD5

      3d73a5800f2af02ef1b3b34a36881227

    • SHA1

      79e3a65dbb62e52bb934639a766919a8861b928d

    • SHA256

      2c45fa1e78858464186bd35154e9cc655ea704ecaa8c87abe274d4d4e304488f

    • SHA512

      c00999beb76d4059f560b0e986130d4c006a6366f9fb27e882a4441dd71902d6d3b763fc8487e678bde6dce491a260f5decc513ebde8154df18387959979a04a

    • SSDEEP

      3072:nPg5Rn+Y3cKnSsU6enXcyJ+jnBkYlGU/MHMRledklufX7hbpvI9UX:nPg5RKKnpUHXmmbU/0j7hFIA

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      0dc0cc7a6d9db685bf05a7e5f3ea4781

    • SHA1

      5d8b6268eeec9d8d904bc9d988a4b588b392213f

    • SHA256

      8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    • SHA512

      814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    • SSDEEP

      192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      RegistInstallCnt.exe

    • Size

      28KB

    • MD5

      a13f46ce6314a6033024f51252270a29

    • SHA1

      0f03027e24898a1462294853175a50870f294fb0

    • SHA256

      a39d15ae4d9ca76665a9d32f484c6aa0512232e892d4a19b07b54ea9448ca499

    • SHA512

      2d7487fa56a873346a24024c4098d11ea909e36d1dd429086652ad7c0a604cc29c58961f9fe2025509b806937ce1c6f2191fbb67cdd8e3f38c8810b3013dd48b

    • SSDEEP

      384:0W6H0tORpTqxPzJQLcNW2EPPmB4S4N1qA4QMIY:0WDtOQzJQEW2E3m2S4zp4QK

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      WinTool.exe

    • Size

      48KB

    • MD5

      9cc9a18f4f0ca6d8fbdbb8d5410f303b

    • SHA1

      69ab499110d32112c15c5cb599fb31f21eb331d5

    • SHA256

      14f68999325122f5fdeaba0c23a94eee68db9c462b6101acc1ffdcce308987dc

    • SHA512

      b0f0f6b31954baf9baef2dc8f7b08daa9dc63a63853763b3576fb87eb3cb675e354e0257344b9532037b50569a696c76fe55c59e0df469b97189232d79c33567

    • SSDEEP

      768:NL6mRbLCM3i4j5mugDohINhEInk5zcBmcLQxPTkfyPJv9:NL6WLCM3Z5mugDohIhtk5zcBPL1OJF

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      uninst.exe

    • Size

      48KB

    • MD5

      90d279bd1f30afa0842f36b8640ebdd5

    • SHA1

      7e382d3d3adf53384e468ff157755396d3610361

    • SHA256

      9a5c97ea1238656c784cd41dc8f75edb1115db2f317e081aa3045a943b090d74

    • SHA512

      cfea9c20d08262c018fe712170b51a5ca15e93cc1ad65efdc2bd8cb5ee03e5c87fe906c64f61ded1955dbe8712863a6fa5efbfc0d6b6e7fa73eae1c35704035a

    • SSDEEP

      1536:GpgpHzb9dZVX9fHMvG0D3XJtgdLeAyNJvk:sgXdZt9P6D3XJtceAl

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks