Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118

  • Size

    544KB

  • Sample

    240814-m2afksybkh

  • MD5

    95cf4689c08a836b1bc6ce87fbf1a895

  • SHA1

    64ee0a6ffe32e31c96b13ce8be219f8d44300b28

  • SHA256

    fd125d57a48c3f167fae13603cd4d4f4c661db870d637f95613625be68a48a88

  • SHA512

    bd2bef62cf6ecf1e7a8c5d7b910ae64a7372841207e04d771753faa0f225794ac014b240900e60086be37ae7205af10e723c3be61ff5148585782d3d5ab62115

  • SSDEEP

    12288:vQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:vQI+cJHiJRTHnxhUqEhe9suB2C8O9O

Malware Config

Targets

    • Target

      95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118

    • Size

      544KB

    • MD5

      95cf4689c08a836b1bc6ce87fbf1a895

    • SHA1

      64ee0a6ffe32e31c96b13ce8be219f8d44300b28

    • SHA256

      fd125d57a48c3f167fae13603cd4d4f4c661db870d637f95613625be68a48a88

    • SHA512

      bd2bef62cf6ecf1e7a8c5d7b910ae64a7372841207e04d771753faa0f225794ac014b240900e60086be37ae7205af10e723c3be61ff5148585782d3d5ab62115

    • SSDEEP

      12288:vQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:vQI+cJHiJRTHnxhUqEhe9suB2C8O9O

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks