Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8803d50c9065603ee66a17e25c1212b0_JaffaCakes118
-
Size
341KB
-
Sample
240810-2x2rlawhpg
-
MD5
8803d50c9065603ee66a17e25c1212b0
-
SHA1
2ded053e1b2a5e854db51003c9cd9b827b85a825
-
SHA256
16ffc1bd6c6c0f8521e4d99a544a0f35d9736e564d2e59fcdeceaa6e34f53d05
-
SHA512
babcaf8cfd0361f869710ec4c4cc911e7e74898613009e61c004473b5010d1fa9a00e245030ba791f01286326c6fa827119ca10e278caefa330f44df2bbf0d60
-
SSDEEP
6144:ZOpslFlqOGHG0hdBCkWYxuukP1pjSKSNVkq/MVJb/:ZwsltOfTBd47GLRMTb/
Behavioral task
behavioral1
Sample
8803d50c9065603ee66a17e25c1212b0_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
cybergate
v1.07.5
remote
pokemonpgm.no-ip.org:100
T16P132D5H180T
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
KamasGenerator
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
FORMATAGE DU DISQUE DUR C: DANS 5 SECONDES ! 5... 4... 3... 2... 1... DISQUE DUR C: FORMATE !
-
message_box_title
FORMATAGE PC
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
8803d50c9065603ee66a17e25c1212b0_JaffaCakes118
-
Size
341KB
-
MD5
8803d50c9065603ee66a17e25c1212b0
-
SHA1
2ded053e1b2a5e854db51003c9cd9b827b85a825
-
SHA256
16ffc1bd6c6c0f8521e4d99a544a0f35d9736e564d2e59fcdeceaa6e34f53d05
-
SHA512
babcaf8cfd0361f869710ec4c4cc911e7e74898613009e61c004473b5010d1fa9a00e245030ba791f01286326c6fa827119ca10e278caefa330f44df2bbf0d60
-
SSDEEP
6144:ZOpslFlqOGHG0hdBCkWYxuukP1pjSKSNVkq/MVJb/:ZwsltOfTBd47GLRMTb/
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2