Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    88f608cc8b962df435952230078c4953_JaffaCakes118

  • Size

    167KB

  • Sample

    240811-ewcprayelc

  • MD5

    88f608cc8b962df435952230078c4953

  • SHA1

    fade95d2e5f0f8f97674784fb68b874b076cde93

  • SHA256

    9a99dbe4da731295a5cada60b513471b9ad3c34b992889ab999ffe24765e2fff

  • SHA512

    cb2289b50e760e7ed52958c64ae66d20fbecd57d3d9a04617c9f81386739c2caddaf804a00aaa8ab4904a2601f62361e3fba48d139b585ff7d379edc69f904f5

  • SSDEEP

    3072:QGEEhtp++sy+rmGVCupPARbC4HbYObKhHvYVxWbtlmMMD8SVr6BhvDbZIVBUVB2F:QGvl4FqO4HsthHg1XD8Cr6BhvD9IVO2F

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      88f608cc8b962df435952230078c4953_JaffaCakes118

    • Size

      167KB

    • MD5

      88f608cc8b962df435952230078c4953

    • SHA1

      fade95d2e5f0f8f97674784fb68b874b076cde93

    • SHA256

      9a99dbe4da731295a5cada60b513471b9ad3c34b992889ab999ffe24765e2fff

    • SHA512

      cb2289b50e760e7ed52958c64ae66d20fbecd57d3d9a04617c9f81386739c2caddaf804a00aaa8ab4904a2601f62361e3fba48d139b585ff7d379edc69f904f5

    • SSDEEP

      3072:QGEEhtp++sy+rmGVCupPARbC4HbYObKhHvYVxWbtlmMMD8SVr6BhvDbZIVBUVB2F:QGvl4FqO4HsthHg1XD8Cr6BhvD9IVO2F

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks