Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118

  • Size

    108KB

  • Sample

    240823-qyxcqazckq

  • MD5

    bbf623d9290d3978cded5be9afe6de3a

  • SHA1

    d59cadcc8ef8cb8f9d67e402c698872f0425153f

  • SHA256

    e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994

  • SHA512

    2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832

  • SSDEEP

    3072:S01G98h0qXYvDNL4KQkL2OsINxhc5bZHhsVMh:ZPJYrNL1Qk7Nc5bnh

Malware Config

Targets

    • Target

      bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118

    • Size

      108KB

    • MD5

      bbf623d9290d3978cded5be9afe6de3a

    • SHA1

      d59cadcc8ef8cb8f9d67e402c698872f0425153f

    • SHA256

      e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994

    • SHA512

      2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832

    • SSDEEP

      3072:S01G98h0qXYvDNL4KQkL2OsINxhc5bZHhsVMh:ZPJYrNL1Qk7Nc5bnh

    • Modifies firewall policy service

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks