Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    be602ca6ddd24492bc74c749d313646d_JaffaCakes118

  • Size

    138KB

  • Sample

    240824-l8py6svene

  • MD5

    be602ca6ddd24492bc74c749d313646d

  • SHA1

    e45b6d37792e4a6f47245fe90ab69dd4d0363af9

  • SHA256

    c6d8baad06ed74c83df58922e84d2ac0ef42913d0c281045f1df15d28d697c97

  • SHA512

    68158201b5fd92094bd03ef225f5808433ab84b959ce41fd9101b0c7470b0c1ac962bb7734923a27dda3637f53200a3b49c35f327534888f27fd10897eb647a7

  • SSDEEP

    3072:7tsaT9r2uHKN/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Gahr2uHKNfYJmaiNyVWPdrc

Malware Config

Targets

    • Target

      be602ca6ddd24492bc74c749d313646d_JaffaCakes118

    • Size

      138KB

    • MD5

      be602ca6ddd24492bc74c749d313646d

    • SHA1

      e45b6d37792e4a6f47245fe90ab69dd4d0363af9

    • SHA256

      c6d8baad06ed74c83df58922e84d2ac0ef42913d0c281045f1df15d28d697c97

    • SHA512

      68158201b5fd92094bd03ef225f5808433ab84b959ce41fd9101b0c7470b0c1ac962bb7734923a27dda3637f53200a3b49c35f327534888f27fd10897eb647a7

    • SSDEEP

      3072:7tsaT9r2uHKN/BDzh/5jrCIHer7Zmv3HSruNyLamWjMAKdWrc:7Gahr2uHKNfYJmaiNyVWPdrc

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks