Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b9a81478c33603bd3b8154ace1dec634_JaffaCakes118

  • Size

    55KB

  • Sample

    240823-arssyswbkg

  • MD5

    b9a81478c33603bd3b8154ace1dec634

  • SHA1

    3a1409a7ceca2c69fd7a356728d10817ed23245f

  • SHA256

    b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d

  • SHA512

    8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0

  • SSDEEP

    768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU

Malware Config

Targets

    • Target

      b9a81478c33603bd3b8154ace1dec634_JaffaCakes118

    • Size

      55KB

    • MD5

      b9a81478c33603bd3b8154ace1dec634

    • SHA1

      3a1409a7ceca2c69fd7a356728d10817ed23245f

    • SHA256

      b12f2000d3f1dfaa1f0372ab36ac1edf7743fe879c82f9009f5821225ee4897d

    • SHA512

      8b7d9bae301cce42b34cdfc677934b43c6f93717b3a6770d4a07bc9d2bc7e775f1bf2cfe78e1d3b36bef05690fb35039da63312210ca24e4d96a5842fd6843b0

    • SSDEEP

      768:Wc648rcDTCuajJ366d1S+lQFvv1YoOMNgbZpuNMrY7JsaeIwDJ8UJJk:WHuajJ366fcYoEtObeaIU

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks