Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

961dbc1aef...18.exe

windows7-x64

8

961dbc1aef...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    961dbc1aef8dc473ac367465075a4708_JaffaCakes118

  • Size

    75KB

  • Sample

    240814-pqqpjaxbmm

  • MD5

    961dbc1aef8dc473ac367465075a4708

  • SHA1

    2da4ef5829b7fb71bfc1d4e7ae3a8bacda6b0f75

  • SHA256

    9966fc9a4ef85925a9500e325f8f371bbe74df367e8c25146f090c4ada940305

  • SHA512

    8dac7fcaaeb62bbb8a5a2b769a36978dde71aedde89c99e2102969485fea3debb8bdb0ed071273fb7a3568158025b85919340e1fe345ab84617bfae099d10e09

  • SSDEEP

    1536:KzJ2W1Dy3qfHTGFq+/UbyyiVz9TwMWpo1rsiV5Spe9EC632B8mA6EZE6:KtbFy3qfH6Yc0r0xTwMWpoTV5SpLQ8x1

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      961dbc1aef8dc473ac367465075a4708_JaffaCakes118

    • Size

      75KB

    • MD5

      961dbc1aef8dc473ac367465075a4708

    • SHA1

      2da4ef5829b7fb71bfc1d4e7ae3a8bacda6b0f75

    • SHA256

      9966fc9a4ef85925a9500e325f8f371bbe74df367e8c25146f090c4ada940305

    • SHA512

      8dac7fcaaeb62bbb8a5a2b769a36978dde71aedde89c99e2102969485fea3debb8bdb0ed071273fb7a3568158025b85919340e1fe345ab84617bfae099d10e09

    • SSDEEP

      1536:KzJ2W1Dy3qfHTGFq+/UbyyiVz9TwMWpo1rsiV5Spe9EC632B8mA6EZE6:KtbFy3qfH6Yc0r0xTwMWpoTV5SpLQ8x1

    Score
    8/10
    discoverypersistenceupx

    • Server Software Component: Terminal Services DLL

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks