Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b4a464d729adbab1ea0504813d374cfb_JaffaCakes118

  • Size

    759KB

  • Sample

    240821-xl19gayemn

  • MD5

    b4a464d729adbab1ea0504813d374cfb

  • SHA1

    f7786eb4a39916e0f1eb1f0ec3fa7147288fdaec

  • SHA256

    95404b05b9b00734ac8e025a4573cd9fd2d9b0d6052041cdeb2d1c1199446854

  • SHA512

    cfa3a68fea6e355ebdac9820f12e2791e0ed254dc5292a0fd5eb198429cf3268440d079f9893def906624aa9a28fcb1c14a993d2bdace0ad226e03726045694d

  • SSDEEP

    12288:iiaVBe8MJDEOoGPab3AsN0bsfXxd/rLnHSCmvP3Ai2MRALhKsQp9sq2Zkod49c7c:kBe9QOonb3gsffLHSCoPQkRALhqidO8c

Malware Config

Targets

    • Target

      b4a464d729adbab1ea0504813d374cfb_JaffaCakes118

    • Size

      759KB

    • MD5

      b4a464d729adbab1ea0504813d374cfb

    • SHA1

      f7786eb4a39916e0f1eb1f0ec3fa7147288fdaec

    • SHA256

      95404b05b9b00734ac8e025a4573cd9fd2d9b0d6052041cdeb2d1c1199446854

    • SHA512

      cfa3a68fea6e355ebdac9820f12e2791e0ed254dc5292a0fd5eb198429cf3268440d079f9893def906624aa9a28fcb1c14a993d2bdace0ad226e03726045694d

    • SSDEEP

      12288:iiaVBe8MJDEOoGPab3AsN0bsfXxd/rLnHSCmvP3Ai2MRALhKsQp9sq2Zkod49c7c:kBe9QOonb3gsffLHSCoPQkRALhqidO8c

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks