Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

c0c8e1e61e...18.dll

windows7-x64

8

c0c8e1e61e...18.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0c8e1e61e4eefb0274bc47008ecd785_JaffaCakes118

  • Size

    60KB

  • Sample

    240825-p4pdmawhll

  • MD5

    c0c8e1e61e4eefb0274bc47008ecd785

  • SHA1

    2b268522599f98327ec2ccda172bd0f5cae0ce3f

  • SHA256

    536e919c702ea954105c42ee7414055c339ff5ec300ae6aeaf4f435c17e953e6

  • SHA512

    6f74ce4b71e8e6e97b3b0cb5648024f7406077ec8bd6cc7f8984c75435f28853a3c6da031e25aa73b8e7df5ea55bc2eb397627cd2b3a1bde4535a62d94e2b2d2

  • SSDEEP

    1536:QJiYU3BupCdtWMrd4IJfzc5TOtnVxhxMU:QJil3BaCdtWxSLMTOtVxgU

Score
8/10
discoverypersistenceprivilege_escalationvmprotect

Malware Config

Targets

    • Target

      c0c8e1e61e4eefb0274bc47008ecd785_JaffaCakes118

    • Size

      60KB

    • MD5

      c0c8e1e61e4eefb0274bc47008ecd785

    • SHA1

      2b268522599f98327ec2ccda172bd0f5cae0ce3f

    • SHA256

      536e919c702ea954105c42ee7414055c339ff5ec300ae6aeaf4f435c17e953e6

    • SHA512

      6f74ce4b71e8e6e97b3b0cb5648024f7406077ec8bd6cc7f8984c75435f28853a3c6da031e25aa73b8e7df5ea55bc2eb397627cd2b3a1bde4535a62d94e2b2d2

    • SSDEEP

      1536:QJiYU3BupCdtWMrd4IJfzc5TOtnVxhxMU:QJil3BaCdtWxSLMTOtVxgU

    Score
    8/10
    discoverypersistenceprivilege_escalationvmprotect

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks