Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c7863ca4746b2fae4495bfa6f3162077_JaffaCakes118

  • Size

    153KB

  • Sample

    240828-yea95svajk

  • MD5

    c7863ca4746b2fae4495bfa6f3162077

  • SHA1

    1c81b9679f8c1cf5999e7a94aedd47bf1cb2b3b0

  • SHA256

    95bf44ad7c1e827f859b2e69838fd936e703546f2b54f60c8acbb1516d93ec1d

  • SHA512

    f4c31c5e01daee0ff6de447949bac02da7809d2779b31d69f11ffa6d87c017a915a6dd878d8921a7cf20afd7d9863323451b9f9212140bfb90c5bfbd44019eef

  • SSDEEP

    3072:s94QzUtkEThySk9oOpz+8GHxmFLtcTjc0MiY1p:s94/h1u2UEjBFY1p

Malware Config

Targets

    • Target

      c7863ca4746b2fae4495bfa6f3162077_JaffaCakes118

    • Size

      153KB

    • MD5

      c7863ca4746b2fae4495bfa6f3162077

    • SHA1

      1c81b9679f8c1cf5999e7a94aedd47bf1cb2b3b0

    • SHA256

      95bf44ad7c1e827f859b2e69838fd936e703546f2b54f60c8acbb1516d93ec1d

    • SHA512

      f4c31c5e01daee0ff6de447949bac02da7809d2779b31d69f11ffa6d87c017a915a6dd878d8921a7cf20afd7d9863323451b9f9212140bfb90c5bfbd44019eef

    • SSDEEP

      3072:s94QzUtkEThySk9oOpz+8GHxmFLtcTjc0MiY1p:s94/h1u2UEjBFY1p

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks