Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
714353dc1fa85bdc2b237a174e588cfc_JaffaCakes118
-
Size
100KB
-
Sample
240725-z3l7zsvfjl
-
MD5
714353dc1fa85bdc2b237a174e588cfc
-
SHA1
0644e6612f1a70e7574b92858b9907701da026f1
-
SHA256
4a46be760ef2ce31476310982e88aa083ad0f8b47a27fe0b063d8dcec835a7b3
-
SHA512
8686d67ae1ab702a898a5c6c97edbc2bf9e30436df8d1611e5fdbf85be0dbd760e26e9b4a068c6ec7bfc82cf62aa856cb7880fc6b7cc074cb9101b21363a172c
-
SSDEEP
1536:4w39JXfqxMPkp+G7rc0wesE7PbjCpp2XQySZHAxYIBSMqTfOGUsg:PPqxYkf/NPbjSZkYIBS1Lss
Static task
static1
Behavioral task
behavioral1
Sample
714353dc1fa85bdc2b237a174e588cfc_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
714353dc1fa85bdc2b237a174e588cfc_JaffaCakes118
-
Size
100KB
-
MD5
714353dc1fa85bdc2b237a174e588cfc
-
SHA1
0644e6612f1a70e7574b92858b9907701da026f1
-
SHA256
4a46be760ef2ce31476310982e88aa083ad0f8b47a27fe0b063d8dcec835a7b3
-
SHA512
8686d67ae1ab702a898a5c6c97edbc2bf9e30436df8d1611e5fdbf85be0dbd760e26e9b4a068c6ec7bfc82cf62aa856cb7880fc6b7cc074cb9101b21363a172c
-
SSDEEP
1536:4w39JXfqxMPkp+G7rc0wesE7PbjCpp2XQySZHAxYIBSMqTfOGUsg:PPqxYkf/NPbjSZkYIBS1Lss
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5