Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9fca9b18cac68e7d6154a7fa6a78dfe5_JaffaCakes118
-
Size
6.6MB
-
Sample
240816-y4rcnavcnh
-
MD5
9fca9b18cac68e7d6154a7fa6a78dfe5
-
SHA1
f51aa529671e4c7312dacaae92bc00270f6e4350
-
SHA256
303ec9a3ed5f4235ce7ab5a0c97f5b9c80596df4fb5e75a0a8848cc6e2b08395
-
SHA512
3cd3b63740552381f25929f4a0fb29ce66254f323f7a5c0be76e99120473cf3db579f1355f1315a820b5c19db6114663aa85c6b3e9f360a8b79261176ce05086
-
SSDEEP
6144:2O3WiXfjoS3G1Gkp9OsCV7N7xgB6zP18Pc79cqNe1KW0aMEcw8X3:2PwWtmjVJ6B677eKe1sLLb
Static task
static1
Behavioral task
behavioral1
Sample
9fca9b18cac68e7d6154a7fa6a78dfe5_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
cybergate
v1.18.0 - Crack Version
0504
050420122037.no-ip.org:8020
3N0GUDM71D10FG
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windows Defender
-
install_file
csrss.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
0504
-
regkey_hkcu
Windows Defender Update
-
regkey_hklm
Windows Defender
Targets
-
-
Target
9fca9b18cac68e7d6154a7fa6a78dfe5_JaffaCakes118
-
Size
6.6MB
-
MD5
9fca9b18cac68e7d6154a7fa6a78dfe5
-
SHA1
f51aa529671e4c7312dacaae92bc00270f6e4350
-
SHA256
303ec9a3ed5f4235ce7ab5a0c97f5b9c80596df4fb5e75a0a8848cc6e2b08395
-
SHA512
3cd3b63740552381f25929f4a0fb29ce66254f323f7a5c0be76e99120473cf3db579f1355f1315a820b5c19db6114663aa85c6b3e9f360a8b79261176ce05086
-
SSDEEP
6144:2O3WiXfjoS3G1Gkp9OsCV7N7xgB6zP18Pc79cqNe1KW0aMEcw8X3:2PwWtmjVJ6B677eKe1sLLb
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2