Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
83d76fa16a0fc9cded8f8dff0962cfee_JaffaCakes118
-
Size
283KB
-
Sample
240809-2mrhwashjm
-
MD5
83d76fa16a0fc9cded8f8dff0962cfee
-
SHA1
6545af7eecc6fd06950a6c50c279387500d77113
-
SHA256
e378807bd28bd46205504a06e37fe3b028e6e0deca075d17cf8c5aaeb0842207
-
SHA512
022766e49e18d8d2429622879b156896c0b91912e011c0b28559d7f2a0df560ef3fd896c7f8fdafa878780e3ab55c043fe40dceffadaccd6bf592efb0a8c432e
-
SSDEEP
6144:krn2ca/TMeqZYgS7zFDIqKjRrpKvmj9TDAbaiUTrudf:krn/0TM/ZYgS7O5BfFAf
Static task
static1
Behavioral task
behavioral1
Sample
83d76fa16a0fc9cded8f8dff0962cfee_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
83d76fa16a0fc9cded8f8dff0962cfee_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
83d76fa16a0fc9cded8f8dff0962cfee_JaffaCakes118
-
Size
283KB
-
MD5
83d76fa16a0fc9cded8f8dff0962cfee
-
SHA1
6545af7eecc6fd06950a6c50c279387500d77113
-
SHA256
e378807bd28bd46205504a06e37fe3b028e6e0deca075d17cf8c5aaeb0842207
-
SHA512
022766e49e18d8d2429622879b156896c0b91912e011c0b28559d7f2a0df560ef3fd896c7f8fdafa878780e3ab55c043fe40dceffadaccd6bf592efb0a8c432e
-
SSDEEP
6144:krn2ca/TMeqZYgS7zFDIqKjRrpKvmj9TDAbaiUTrudf:krn/0TM/ZYgS7O5BfFAf
-
Modifies security service
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3