Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8a86537c1c4e6f6c1548fdd86c079ac8_JaffaCakes118
-
Size
477KB
-
Sample
240811-qnd4dswajg
-
MD5
8a86537c1c4e6f6c1548fdd86c079ac8
-
SHA1
93c4f146069938dd5febef6651915bcc8b6878af
-
SHA256
e2382b933d8f278665620c6980454447f5f5dd9cdbc6f18e019544fb8bfe0406
-
SHA512
d03da5f6936326ee6095663a9a451aba9c4b592386f6437bf0cf9d05bbb69bdfce4d062ce7abacd7ab03a2e7bfacc30267824f2df03b26ba3027c1516dde8a72
-
SSDEEP
12288:C+9vr7Ubx/PZf3YJkayls/HeH66f1v8LmtUMZ:Tr7UdpY6YGHXl8LNMZ
Behavioral task
behavioral1
Sample
8a86537c1c4e6f6c1548fdd86c079ac8_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8a86537c1c4e6f6c1548fdd86c079ac8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
8a86537c1c4e6f6c1548fdd86c079ac8_JaffaCakes118
-
Size
477KB
-
MD5
8a86537c1c4e6f6c1548fdd86c079ac8
-
SHA1
93c4f146069938dd5febef6651915bcc8b6878af
-
SHA256
e2382b933d8f278665620c6980454447f5f5dd9cdbc6f18e019544fb8bfe0406
-
SHA512
d03da5f6936326ee6095663a9a451aba9c4b592386f6437bf0cf9d05bbb69bdfce4d062ce7abacd7ab03a2e7bfacc30267824f2df03b26ba3027c1516dde8a72
-
SSDEEP
12288:C+9vr7Ubx/PZf3YJkayls/HeH66f1v8LmtUMZ:Tr7UdpY6YGHXl8LNMZ
Score10/10-
Modifies WinLogon for persistence
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1