Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7586767ca002ce283dfc9395f8d42449_JaffaCakes118

  • Size

    381KB

  • Sample

    240726-yt6pla1hjq

  • MD5

    7586767ca002ce283dfc9395f8d42449

  • SHA1

    1c22953363ca7086af09095972231c8b14fa3d72

  • SHA256

    9ce6ccb2d3d78eeec8af6e1cf03bc17392b359e4acd677ae9660efedc54e8740

  • SHA512

    e0338914276ddfdc9d796c100db022795cb8f0be1c9d41926c0449a284e9611e11e859314904937c644687d36bec0f24690f9ad5d551b758b9effacef527eca1

  • SSDEEP

    6144:XTq+5yQlE60f9Rm1K5yg7DMK+LMygPUH5JrkhqVdDXpBs6/YOs7fGy185jLupoCb:DnyQlE6qnrt7DVHUvrkhqTZBsX51S6pb

Malware Config

Targets

    • Target

      7586767ca002ce283dfc9395f8d42449_JaffaCakes118

    • Size

      381KB

    • MD5

      7586767ca002ce283dfc9395f8d42449

    • SHA1

      1c22953363ca7086af09095972231c8b14fa3d72

    • SHA256

      9ce6ccb2d3d78eeec8af6e1cf03bc17392b359e4acd677ae9660efedc54e8740

    • SHA512

      e0338914276ddfdc9d796c100db022795cb8f0be1c9d41926c0449a284e9611e11e859314904937c644687d36bec0f24690f9ad5d551b758b9effacef527eca1

    • SSDEEP

      6144:XTq+5yQlE60f9Rm1K5yg7DMK+LMygPUH5JrkhqVdDXpBs6/YOs7fGy185jLupoCb:DnyQlE6qnrt7DVHUvrkhqTZBsX51S6pb

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

    • Target

      content/browserLoad.js

    • Size

      23KB

    • MD5

      105a9a6fae77ee227513d015d6ed723c

    • SHA1

      6748ec4c2ed7d8aa6083f3f79abd70d355810cc1

    • SHA256

      0aa684d4ff8a9dee9c81e564c9e62591932215b8801d613c6d97b58181dc899d

    • SHA512

      0ed8ffa163edc8b179c82b7e5c9455c02ff78870a151a85eb897c376a166f026ee7d43dea2fe6f61ffb9ade6964fac93da3aff1c44a5f8cc87ec74a0b93122a1

    • SSDEEP

      384:4aPJHE8YO+j2GEtwk/69DbY2a2aWT02wOg42sOd4NY:4aPiROvtwkC9Bt/nqjD

    Score
    3/10
    • Target

      content/domLoad.js

    • Size

      40KB

    • MD5

      accfbc4564ce804f5314ab5600897b0e

    • SHA1

      0b3b17c2685d67731aa1b4b7356a337454c8e278

    • SHA256

      db0515696d6da65bcb61a85c6a9c2f3cb524da6d1c203fdbf1ec28fbb3202873

    • SHA512

      ee934bd32aaf5226c7618c6bcc4a7b67b59db7788ca4f1e86b68240b7eb3cc5c586059bf956efd51a539524e538998abc5176454cd4d93cd0e3983a5eddc3a95

    • SSDEEP

      384:c43erjfsEmZWUbIrD/c/8fcIXKfeY15Km3WLCbx35k4CAyg1w+jjKvcG45yCew/8:cmZWFAnz8fL85kG1/jKvcPbJvc

    Score
    3/10
    • Target

      content/priam.js

    • Size

      38KB

    • MD5

      c9b214ecbd9d6fce6e0679092fd8ea62

    • SHA1

      4349c3e8863671c8d84a8a6f29d331ac396cce5e

    • SHA256

      bca43ccdc99923fa1349e85d8b97312704e212e00ef6a056f2c619a98d3b98b4

    • SHA512

      156074d3e6344f2f4fc3b5af1fab8cd47eae8d4d88cda73e693f046eb8f76499086ce0e51416b6d2e3caa8123176565ed1965b4c0b27495debb96f7f5a2eaa78

    • SSDEEP

      768:hYL5xJ8PQjqa2Ki/lNWW4R5/bmXZMFHDQZej7uZtbzYpPT:h25xJ8PQjq1ePRYyVQMj7otbzYZT

    Score
    3/10
    • Target

      defaults/preferences/priam_prefs.js

    • Size

      215B

    • MD5

      59a182054d365c813dbbf1fd49752ce2

    • SHA1

      ccc53e0ea98c626c56bb48b74d293fb1fcff5606

    • SHA256

      2e3373c365847a53efb14ccb1495c01ad69205409d8a4b9ff39a23bad5f63459

    • SHA512

      205d8c7abf5d47aa360ca681bd44fa099e4a0e3363db25db4f977b7fea9712d847145e28c8fa37234138a201e38da2f51a3b2bb9983b5ed5afc7757e7b92fcc0

    Score
    3/10
    • Target

      html/background.html

    • Size

      339B

    • MD5

      6563563700def9063a31a4cdddbda4cd

    • SHA1

      0bb2c1a00fead8cff96ef88a979161e1c64ca28d

    • SHA256

      99a32a6f8fa6927fd7275ef77720e2758a70a98c443c69fd2426200fd384e9db

    • SHA512

      ad6f5d9d93015d0660ff6fdd2e7ada5e3e33ba43d68fe7ac8ec5c2a9978577be0825cad66e2d0a01871dcf1a8d46448059cd4b399a4c12d9698f88590b232216

    Score
    3/10
    • Target

      js/background.js

    • Size

      48KB

    • MD5

      7b74be8da3a0295531f4a5c69068a3d0

    • SHA1

      23ab64db7458bb990e482ca1394dc4004c1f5738

    • SHA256

      77ee0a2be5300c3dd75f2f5e8a8b85bb408f1eb3fdcae5a9f72256d1019eeec7

    • SHA512

      ca4b2e50159e6acb318e538a078f150883071b845a45464460f984ffd28c5527995eb84126d8c2c345e8f83806bec001bb4fd63a2246726821fae102e6d2a78b

    • SSDEEP

      384:VE/r6nyL5abYbHkQ+qB4dou6ngm8oxKHSGIR2Zb/CKADzqA/RHgQdXX25K:VS/L5EEHkQ+qmolnqoxKHSGI4UvHeSj

    Score
    3/10
    • Target

      js/domLoad.js

    • Size

      28KB

    • MD5

      7cd147a6db756ced4ae70be8491e783d

    • SHA1

      a15cdedc39a5108743d90584b471e0d6fb154f94

    • SHA256

      8b39ba0c0c25d1e441f1e09078f9db7cd028e2bc21df40bd7e5426fd3217ada7

    • SHA512

      080b61b90f79ad7c635c945dd5568b28f35401a800ae5ef8540f8b89162617f19f29ccb7a7b2b6d7b970e36c0276d1305e5e7d86011e3c07d82e54cc8c49c71a

    • SSDEEP

      384:crU3FlJT40Nb6Xp2ffIOAa+ECKrynfMTTvj2PRKRhRsYdUw/fm:zQp/KYfMXvmRKRh7dh2

    Score
    3/10
    • Target

      js/priam.js

    • Size

      15KB

    • MD5

      dcb9815fc63d7f3a7f544444c4227f02

    • SHA1

      4867c3185f2a644a5d4b1d7182ef831a98dbc86e

    • SHA256

      0e3317afcc87cea3717b50bc6b8a1e28f190def65d5ddc17a28b62ccdd8d9455

    • SHA512

      5957fad674b6e6f80055f950d2fb85999642e760f4e3e43c54dfc6f50217f3a8927e092bbe78ead07f6f2196f0d90ebf2f5899b98028998d5598234b7f7c044c

    • SSDEEP

      192:PfOG+QbYcSDSDRyk7kpfLmCZsuGP4/wTsOE1z3mfV7kwYsrTR5KvFS:PfFbYSDRIlnsdP4/AvmwgdS

    Score
    3/10
    • Target

      plugins/PriamNPAPI.dll

    • Size

      55KB

    • MD5

      0912d0ccfd6cbefe2bd6b4473d006771

    • SHA1

      ed9dad52f3ae71472b810bfa71159d448cf3e68d

    • SHA256

      c8493605aae1563e133b20543d02aa421f477b9a955fd547f7d2c7cdc1dd787d

    • SHA512

      dfbe41244bfc321a9efa717924bc8cd527d422eded98c4bd0c3c8391a0bdb8619571f2c757a825cadd145ce07b235714625326fc4c16ccaef67d71a576ae1142

    • SSDEEP

      768:FHeShZpSern/Z0RI8lexCL5KoThZVL4ckkx9c/UK0EDDqnjV5WLNtZXzhOn:BpZpSer/ZalXZVLDkH/UCkuLHJzhO

    Score
    3/10
    • Target

      $PLUGINSDIR/DcryptDll.dll

    • Size

      14KB

    • MD5

      904beebec2790ee2ca0c90fc448ac7e0

    • SHA1

      40fabf1eb0a3b7168351c4514c5288216cb1566d

    • SHA256

      f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222

    • SHA512

      8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa

    • SSDEEP

      192:apY9VuCnNCbs8dNyHdrvr5T1KEtx/9ehuhiDTUkSv/DxRyeHk51I7n13Xm:aptMNUjyVvGWxauhiDDS3DnyK7nF

    Score
    3/10
    • Target

      $PLUGINSDIR/IpConfig.dll

    • Size

      114KB

    • MD5

      a3ed6f7ea493b9644125d494fbf9a1e6

    • SHA1

      ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8

    • SHA256

      ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08

    • SHA512

      7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1

    • SSDEEP

      1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7

    Score
    3/10
    • Target

      $PLUGINSDIR/MoreInfo.dll

    • Size

      7KB

    • MD5

      80e34b7f576b710d100f6e7c0bed0c2e

    • SHA1

      2b5b895034d41ee0d0d01bf650594ad0d1346662

    • SHA256

      569d62345f6c915236772fa2575d1806cd2bfe089505807cb477618f1eeccf99

    • SHA512

      f5970c192b7089040fd1cf26e5cab131879b91722dff0216cdc735f9cfde1eda061409b579eb0f11e3b32e5513e34bbedd4050b75bb1b2acc81be814c2c6c59b

    • SSDEEP

      96:lvIIAHGrJ65YtNxxDuekBSE4OTpsxKaVK4:5IVA65CNxIHk9ayxKaVK4

    Score
    3/10
    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      20KB

    • MD5

      4c01fdfd2b57b32046b3b3635a4f4df8

    • SHA1

      e0af8e418cbe2b2783b5de93279a3b5dcb73490e

    • SHA256

      b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

    • SHA512

      cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

    • SSDEEP

      384:rJBJ8VnX8K+uKn2WQJdxbs3aEUhU7ya4L60Ac9khYLMkIX0+GwNyEAG:3J8+K+uK2WQJdxbsqEUhUua4L6AG

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      acc2b699edfea5bf5aae45aba3a41e96

    • SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

    • SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

    • SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • SSDEEP

      96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

adwarediscoveryspywarestealer
Score
7/10

behavioral2

adwarediscoveryspywarestealer
Score
7/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10