Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118
-
Size
157KB
-
Sample
240817-j828dswdja
-
MD5
a1d15bcb93da89f08fdfaf4485ed5c69
-
SHA1
ae7982fb0b7e2f5c0d8c689430264571a807266f
-
SHA256
bff61a91ce28a7dbd727861fa4082fbd41d0d95f886117cc3841e30e9d81e44d
-
SHA512
19123d180830261f76155494d4266b2c4bb4d70d71c16ea2a17494dcc1fde62f1e33d8b74e2266d4f5a315ff391a869e8a7a4f1eb5f1c25cd2299563027042a4
-
SSDEEP
3072:lWDnaKMq9HV05S1zwLv/dBTtaODXg9vjfE+mzpZ428:2aHq965S1zcTDXg9vjfEVN8
Static task
static1
Behavioral task
behavioral1
Sample
a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118
-
Size
157KB
-
MD5
a1d15bcb93da89f08fdfaf4485ed5c69
-
SHA1
ae7982fb0b7e2f5c0d8c689430264571a807266f
-
SHA256
bff61a91ce28a7dbd727861fa4082fbd41d0d95f886117cc3841e30e9d81e44d
-
SHA512
19123d180830261f76155494d4266b2c4bb4d70d71c16ea2a17494dcc1fde62f1e33d8b74e2266d4f5a315ff391a869e8a7a4f1eb5f1c25cd2299563027042a4
-
SSDEEP
3072:lWDnaKMq9HV05S1zwLv/dBTtaODXg9vjfE+mzpZ428:2aHq965S1zcTDXg9vjfEVN8
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6