Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a9c23eddb8ccb3008ef6dcf7500dc833_JaffaCakes118

  • Size

    680KB

  • Sample

    240819-f4q3sawfnc

  • MD5

    a9c23eddb8ccb3008ef6dcf7500dc833

  • SHA1

    14440dd1c9dcb5ee0aafacd4fa6e4457ac8bf1da

  • SHA256

    70fa8d9e6b819e18967b7e4d8a7fc50030800c9427d66b657dda837a0a434052

  • SHA512

    415d65be32ee25d5b1e1676e005bbb315aced8597e11038c5bcaae0541b15715767bc72f7a22e17eacc0eb1436a04204c6df51344df34a1ad1a2b3b51d65403e

  • SSDEEP

    12288:qClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:fOhKpYyB/MrxRAZMES+b+

Malware Config

Targets

    • Target

      a9c23eddb8ccb3008ef6dcf7500dc833_JaffaCakes118

    • Size

      680KB

    • MD5

      a9c23eddb8ccb3008ef6dcf7500dc833

    • SHA1

      14440dd1c9dcb5ee0aafacd4fa6e4457ac8bf1da

    • SHA256

      70fa8d9e6b819e18967b7e4d8a7fc50030800c9427d66b657dda837a0a434052

    • SHA512

      415d65be32ee25d5b1e1676e005bbb315aced8597e11038c5bcaae0541b15715767bc72f7a22e17eacc0eb1436a04204c6df51344df34a1ad1a2b3b51d65403e

    • SSDEEP

      12288:qClephVMo7IYJAB++2RrxRAjbeNC2v+clES+vYOqH:fOhKpYyB/MrxRAZMES+b+

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies visiblity of hidden/system files in Explorer

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks