Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b4a464d729adbab1ea0504813d374cfb_JaffaCakes118
-
Size
759KB
-
Sample
240821-xl19gayemn
-
MD5
b4a464d729adbab1ea0504813d374cfb
-
SHA1
f7786eb4a39916e0f1eb1f0ec3fa7147288fdaec
-
SHA256
95404b05b9b00734ac8e025a4573cd9fd2d9b0d6052041cdeb2d1c1199446854
-
SHA512
cfa3a68fea6e355ebdac9820f12e2791e0ed254dc5292a0fd5eb198429cf3268440d079f9893def906624aa9a28fcb1c14a993d2bdace0ad226e03726045694d
-
SSDEEP
12288:iiaVBe8MJDEOoGPab3AsN0bsfXxd/rLnHSCmvP3Ai2MRALhKsQp9sq2Zkod49c7c:kBe9QOonb3gsffLHSCoPQkRALhqidO8c
Static task
static1
Behavioral task
behavioral1
Sample
b4a464d729adbab1ea0504813d374cfb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b4a464d729adbab1ea0504813d374cfb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
b4a464d729adbab1ea0504813d374cfb_JaffaCakes118
-
Size
759KB
-
MD5
b4a464d729adbab1ea0504813d374cfb
-
SHA1
f7786eb4a39916e0f1eb1f0ec3fa7147288fdaec
-
SHA256
95404b05b9b00734ac8e025a4573cd9fd2d9b0d6052041cdeb2d1c1199446854
-
SHA512
cfa3a68fea6e355ebdac9820f12e2791e0ed254dc5292a0fd5eb198429cf3268440d079f9893def906624aa9a28fcb1c14a993d2bdace0ad226e03726045694d
-
SSDEEP
12288:iiaVBe8MJDEOoGPab3AsN0bsfXxd/rLnHSCmvP3Ai2MRALhKsQp9sq2Zkod49c7c:kBe9QOonb3gsffLHSCoPQkRALhqidO8c
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1