Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d16ce7cf123a64124e62853b6334fb85_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240907-jm8haataqd

  • MD5

    d16ce7cf123a64124e62853b6334fb85

  • SHA1

    dffee691c7c1010c8a410057ebdce003631055bc

  • SHA256

    e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e

  • SHA512

    1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b

  • SSDEEP

    24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U

Malware Config

Targets

    • Target

      d16ce7cf123a64124e62853b6334fb85_JaffaCakes118

    • Size

      1.0MB

    • MD5

      d16ce7cf123a64124e62853b6334fb85

    • SHA1

      dffee691c7c1010c8a410057ebdce003631055bc

    • SHA256

      e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e

    • SHA512

      1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b

    • SSDEEP

      24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook accounts

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks