Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118
-
Size
2.5MB
-
Sample
240823-r5vcdazgnb
-
MD5
bc2cfbc203f01930cb56f143d26856fb
-
SHA1
9f08d0a201ffae04d835864aad3e84a5bc7fe7f5
-
SHA256
f39643b37ec937d7955ed787baf39869d9823c4cb8d58a552e62956bc8a1c1b1
-
SHA512
951a3ca3c125c9c01803e3b363b679e3fb47afb88671306bea784080ac4d4149d53fcc803bb4e7e76bbb6550df44908031f0af32dce67d5f681a467da65ac108
-
SSDEEP
49152:zZEq5/FFhaH5k8ZMCzeDpiqzukgMBwZneQlllb7pEnYWH:NX5dPaZkaMZD1rJw/lllb7piYWH
Static task
static1
Behavioral task
behavioral1
Sample
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=EXCFTDUU&2=i-s&3=77&4=7601&5=6&6=1&7=99600&8=1033
Extracted
http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=MKDTRXIT&2=i-s&3=77&4=9200&5=6&6=2&7=919041&8=1033
Targets
-
-
Target
bc2cfbc203f01930cb56f143d26856fb_JaffaCakes118
-
Size
2.5MB
-
MD5
bc2cfbc203f01930cb56f143d26856fb
-
SHA1
9f08d0a201ffae04d835864aad3e84a5bc7fe7f5
-
SHA256
f39643b37ec937d7955ed787baf39869d9823c4cb8d58a552e62956bc8a1c1b1
-
SHA512
951a3ca3c125c9c01803e3b363b679e3fb47afb88671306bea784080ac4d4149d53fcc803bb4e7e76bbb6550df44908031f0af32dce67d5f681a467da65ac108
-
SSDEEP
49152:zZEq5/FFhaH5k8ZMCzeDpiqzukgMBwZneQlllb7pEnYWH:NX5dPaZkaMZD1rJw/lllb7piYWH
-
Modifies WinLogon for persistence
-
Blocklisted process makes network request
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
2