Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
82feaf4427aff3dbad0a259b45bff63d_JaffaCakes118
-
Size
3.0MB
-
Sample
240802-et9lpszeqa
-
MD5
82feaf4427aff3dbad0a259b45bff63d
-
SHA1
f1ca08e6a0866b42e3f7ed7c2e1e1d3ad7a5ceac
-
SHA256
9a5bdddfeddbfaf15804092d2dd4c0f0edf84ca91781a57ef87a24e2e53c0f31
-
SHA512
a196d170e7e17b7fbb249bb150cdf088e951183a97687786dbd6935039518b06527be69f7d6c79323f373f8a6d68b0a25c572f5f97962fd40b117a14f777e498
-
SSDEEP
98304:MDHEfh0QVKtQkgC22K2uJ6AOsmKC81PBTcGcqpXmw8VSfVN7G97BmONSciOi2:m8atgujKC81PBIGcZcNN2EciO/
Behavioral task
behavioral1
Sample
82feaf4427aff3dbad0a259b45bff63d_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
82feaf4427aff3dbad0a259b45bff63d_JaffaCakes118.exe
Resource
win10v2004-20240730-en
Malware Config
Targets
-
-
Target
82feaf4427aff3dbad0a259b45bff63d_JaffaCakes118
-
Size
3.0MB
-
MD5
82feaf4427aff3dbad0a259b45bff63d
-
SHA1
f1ca08e6a0866b42e3f7ed7c2e1e1d3ad7a5ceac
-
SHA256
9a5bdddfeddbfaf15804092d2dd4c0f0edf84ca91781a57ef87a24e2e53c0f31
-
SHA512
a196d170e7e17b7fbb249bb150cdf088e951183a97687786dbd6935039518b06527be69f7d6c79323f373f8a6d68b0a25c572f5f97962fd40b117a14f777e498
-
SSDEEP
98304:MDHEfh0QVKtQkgC22K2uJ6AOsmKC81PBTcGcqpXmw8VSfVN7G97BmONSciOi2:m8atgujKC81PBIGcZcNN2EciO/
-
Modifies Windows Firewall
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1