Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

a9673a6409...18.exe

windows7-x64

7

a9673a6409...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9673a640959a66cbb6596fed4a72497_JaffaCakes118

  • Size

    22KB

  • Sample

    240819-d1w4hsvhjn

  • MD5

    a9673a640959a66cbb6596fed4a72497

  • SHA1

    1275074bd691d79a4dd9406d9eb0976b54989966

  • SHA256

    047c693d0f015753f3647f3afee2ef7350aaacc1fd9daca5fe0ed08ed1f07fbf

  • SHA512

    c19b0c36e108670fc7ae28d0da5cd8c736728d3a7cbcf4152590431aa0a65583d5d2c5ac86ebefe2ea91d4bc70aa59d4503f505f26fffef81ebec31f809f5b97

  • SSDEEP

    384:EMYqDBnNhQsIQyoKMZE0N0Jxg/0MVhFwgPYFsWO2/qFCUbaftmemihGJUzZNkAME:6IhLIQyJMZEAb/JHFvPlf2/sbafttmib

Score
10/10
discoverypersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      a9673a640959a66cbb6596fed4a72497_JaffaCakes118

    • Size

      22KB

    • MD5

      a9673a640959a66cbb6596fed4a72497

    • SHA1

      1275074bd691d79a4dd9406d9eb0976b54989966

    • SHA256

      047c693d0f015753f3647f3afee2ef7350aaacc1fd9daca5fe0ed08ed1f07fbf

    • SHA512

      c19b0c36e108670fc7ae28d0da5cd8c736728d3a7cbcf4152590431aa0a65583d5d2c5ac86ebefe2ea91d4bc70aa59d4503f505f26fffef81ebec31f809f5b97

    • SSDEEP

      384:EMYqDBnNhQsIQyoKMZE0N0Jxg/0MVhFwgPYFsWO2/qFCUbaftmemihGJUzZNkAME:6IhLIQyJMZEAb/JHFvPlf2/sbafttmib

    Score
    10/10
    discoveryupxpersistenceprivilege_escalation

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks