Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118
-
Size
1.0MB
-
Sample
240907-jm8haataqd
-
MD5
d16ce7cf123a64124e62853b6334fb85
-
SHA1
dffee691c7c1010c8a410057ebdce003631055bc
-
SHA256
e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e
-
SHA512
1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b
-
SSDEEP
24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U
Static task
static1
Behavioral task
behavioral1
Sample
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118
-
Size
1.0MB
-
MD5
d16ce7cf123a64124e62853b6334fb85
-
SHA1
dffee691c7c1010c8a410057ebdce003631055bc
-
SHA256
e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e
-
SHA512
1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b
-
SSDEEP
24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-