Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118

  • Size

    157KB

  • Sample

    240817-j828dswdja

  • MD5

    a1d15bcb93da89f08fdfaf4485ed5c69

  • SHA1

    ae7982fb0b7e2f5c0d8c689430264571a807266f

  • SHA256

    bff61a91ce28a7dbd727861fa4082fbd41d0d95f886117cc3841e30e9d81e44d

  • SHA512

    19123d180830261f76155494d4266b2c4bb4d70d71c16ea2a17494dcc1fde62f1e33d8b74e2266d4f5a315ff391a869e8a7a4f1eb5f1c25cd2299563027042a4

  • SSDEEP

    3072:lWDnaKMq9HV05S1zwLv/dBTtaODXg9vjfE+mzpZ428:2aHq965S1zcTDXg9vjfEVN8

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118

    • Size

      157KB

    • MD5

      a1d15bcb93da89f08fdfaf4485ed5c69

    • SHA1

      ae7982fb0b7e2f5c0d8c689430264571a807266f

    • SHA256

      bff61a91ce28a7dbd727861fa4082fbd41d0d95f886117cc3841e30e9d81e44d

    • SHA512

      19123d180830261f76155494d4266b2c4bb4d70d71c16ea2a17494dcc1fde62f1e33d8b74e2266d4f5a315ff391a869e8a7a4f1eb5f1c25cd2299563027042a4

    • SSDEEP

      3072:lWDnaKMq9HV05S1zwLv/dBTtaODXg9vjfE+mzpZ428:2aHq965S1zcTDXg9vjfEVN8

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks