Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

81c05fc6db...18.exe

windows7-x64

10

81c05fc6db...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81c05fc6dbfb233a888ffbbfc70b45f8_JaffaCakes118

  • Size

    456KB

  • Sample

    240801-zderlszgke

  • MD5

    81c05fc6dbfb233a888ffbbfc70b45f8

  • SHA1

    320b27c1559c4681609e938333c344257fb140e3

  • SHA256

    8aad323f30f4c351b4322313e0ef00a8ea1d69a93b209ab52cebc396db9b7ac4

  • SHA512

    f6e3b7a28bff0dcf3ea2d07fe12c53a261a37a088de6882f8b2e4040182edb74aeef64aba5c45ae1d9a34df7d9fa9f306fc0d8c15b8a29f5473d61a59c6839d6

  • SSDEEP

    12288:jEVXKpmokkif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRMiAJgMe3H2cJCx1YOb7i

Score
10/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      81c05fc6dbfb233a888ffbbfc70b45f8_JaffaCakes118

    • Size

      456KB

    • MD5

      81c05fc6dbfb233a888ffbbfc70b45f8

    • SHA1

      320b27c1559c4681609e938333c344257fb140e3

    • SHA256

      8aad323f30f4c351b4322313e0ef00a8ea1d69a93b209ab52cebc396db9b7ac4

    • SHA512

      f6e3b7a28bff0dcf3ea2d07fe12c53a261a37a088de6882f8b2e4040182edb74aeef64aba5c45ae1d9a34df7d9fa9f306fc0d8c15b8a29f5473d61a59c6839d6

    • SSDEEP

      12288:jEVXKpmokkif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRMiAJgMe3H2cJCx1YOb7i

    Score
    10/10
    bootkitdiscoveryevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks