Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
af650378d1f97f393222ddade97f3b80_JaffaCakes118
-
Size
46KB
-
Sample
240820-qnwnfatgjf
-
MD5
af650378d1f97f393222ddade97f3b80
-
SHA1
7c14819b7d77e8185b001a406e2dd7d5eb26fc03
-
SHA256
8376f0339a4ab9d075eec56fae72b7b958c5886f2d0157b4e59af0130ceb710f
-
SHA512
da73ec6463d3366ea2fdf77f3c41275a22c506a28dea2a11fd060355ce77a45e5c4f4357b813cb45c2fc17dba2e74304857d714d78bbbdb287fa6835c6be2132
-
SSDEEP
768:8VtIWP3PTX/rjmUg9hwSsS1bIySiG++4yGOy8OA/U5On04czvEysrel:8VxrvrjmUQKSsVh+Xh8OA/U5OTcjEysG
Static task
static1
Behavioral task
behavioral1
Sample
af650378d1f97f393222ddade97f3b80_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
af650378d1f97f393222ddade97f3b80_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
af650378d1f97f393222ddade97f3b80_JaffaCakes118
-
Size
46KB
-
MD5
af650378d1f97f393222ddade97f3b80
-
SHA1
7c14819b7d77e8185b001a406e2dd7d5eb26fc03
-
SHA256
8376f0339a4ab9d075eec56fae72b7b958c5886f2d0157b4e59af0130ceb710f
-
SHA512
da73ec6463d3366ea2fdf77f3c41275a22c506a28dea2a11fd060355ce77a45e5c4f4357b813cb45c2fc17dba2e74304857d714d78bbbdb287fa6835c6be2132
-
SSDEEP
768:8VtIWP3PTX/rjmUg9hwSsS1bIySiG++4yGOy8OA/U5On04czvEysrel:8VxrvrjmUQKSsVh+Xh8OA/U5OTcjEysG
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1