Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bdb667f12e906f4d6e235124f8bc11f0_JaffaCakes118
-
Size
4.9MB
-
Sample
240824-bg6gqsxeka
-
MD5
bdb667f12e906f4d6e235124f8bc11f0
-
SHA1
b12cd62e9564236637a2cf0ce02ac192299bc83e
-
SHA256
f6906e2636e05a8f894282cd4c824d53273aab85d82c3a7e9a8e2543882c4d96
-
SHA512
bdaa815b813ecdef785a45987f6b9f44ccb1ef87f1ea143be60c83f7aa0f2aaa33a2ed6cc1e8f8d52111bf4cf6f7e6aa2dc55106b96f4ebfa264502d01f33819
-
SSDEEP
98304:NrQZWrQZlrQZWrQZlrQZWrQZlrQZWrQZlrQZWrQZ8:Nr2Wr2lr2Wr2lr2Wr2lr2Wr2lr2Wr28
Static task
static1
Behavioral task
behavioral1
Sample
bdb667f12e906f4d6e235124f8bc11f0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bdb667f12e906f4d6e235124f8bc11f0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
bdb667f12e906f4d6e235124f8bc11f0_JaffaCakes118
-
Size
4.9MB
-
MD5
bdb667f12e906f4d6e235124f8bc11f0
-
SHA1
b12cd62e9564236637a2cf0ce02ac192299bc83e
-
SHA256
f6906e2636e05a8f894282cd4c824d53273aab85d82c3a7e9a8e2543882c4d96
-
SHA512
bdaa815b813ecdef785a45987f6b9f44ccb1ef87f1ea143be60c83f7aa0f2aaa33a2ed6cc1e8f8d52111bf4cf6f7e6aa2dc55106b96f4ebfa264502d01f33819
-
SSDEEP
98304:NrQZWrQZlrQZWrQZlrQZWrQZlrQZWrQZlrQZWrQZ8:Nr2Wr2lr2Wr2lr2Wr2lr2Wr2lr2Wr28
-
Modifies visibility of file extensions in Explorer
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Indicator Removal
1File Deletion
1Modify Registry
1