Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d1f7ecafc4c04756d0c28dedef0eab46_JaffaCakes118

  • Size

    70KB

  • Sample

    240907-p1jc7swekm

  • MD5

    d1f7ecafc4c04756d0c28dedef0eab46

  • SHA1

    53110ab6a6567d07c45579c3521f9e8ebbc5138d

  • SHA256

    59363892458665bc5c9d40c75df376b27d3cc376f080872f5dd35019c3e665d4

  • SHA512

    a53ffb8e9da9932c5c0e5fcae040d076c44ccb441b727735625b69883154c1a92e7747e2283c053e6b197c0476cf915cc9d27d099659a7d66d5ec346319a3acc

  • SSDEEP

    1536:9YaanUI1rYKGZfl6MafHmibbqxDWFAUsWd8BR27MDU5yfmcYub:uam1MPZtcGubv8Wd8v27klfmc1

Malware Config

Targets

    • Target

      d1f7ecafc4c04756d0c28dedef0eab46_JaffaCakes118

    • Size

      70KB

    • MD5

      d1f7ecafc4c04756d0c28dedef0eab46

    • SHA1

      53110ab6a6567d07c45579c3521f9e8ebbc5138d

    • SHA256

      59363892458665bc5c9d40c75df376b27d3cc376f080872f5dd35019c3e665d4

    • SHA512

      a53ffb8e9da9932c5c0e5fcae040d076c44ccb441b727735625b69883154c1a92e7747e2283c053e6b197c0476cf915cc9d27d099659a7d66d5ec346319a3acc

    • SSDEEP

      1536:9YaanUI1rYKGZfl6MafHmibbqxDWFAUsWd8BR27MDU5yfmcYub:uam1MPZtcGubv8Wd8v27klfmc1

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks