Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c0db96aabaac2dff796ebcab5e29c9e9_JaffaCakes118

  • Size

    255KB

  • Sample

    240825-qvy25sydjm

  • MD5

    c0db96aabaac2dff796ebcab5e29c9e9

  • SHA1

    89e8a3a36cd167dfbf1ba66c3d613c85eb967f5b

  • SHA256

    8e707874e515833aa45dac24aaf1ddb66c5901384b2396f73217f711340b3859

  • SHA512

    2bdbf024b6a1305a3070f2b92711f936c4827a5f9dd560c4620e2c8d5fccf573b5e76ed0c3c08cb719a5aef59074ad1ad837f60ff6c8ceb4808d8a05c1bad516

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJD:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg

Malware Config

Targets

    • Target

      c0db96aabaac2dff796ebcab5e29c9e9_JaffaCakes118

    • Size

      255KB

    • MD5

      c0db96aabaac2dff796ebcab5e29c9e9

    • SHA1

      89e8a3a36cd167dfbf1ba66c3d613c85eb967f5b

    • SHA256

      8e707874e515833aa45dac24aaf1ddb66c5901384b2396f73217f711340b3859

    • SHA512

      2bdbf024b6a1305a3070f2b92711f936c4827a5f9dd560c4620e2c8d5fccf573b5e76ed0c3c08cb719a5aef59074ad1ad837f60ff6c8ceb4808d8a05c1bad516

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJD:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks