Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d227de4c423a3ac17045fb5ab06900ea_JaffaCakes118
-
Size
2.6MB
-
Sample
240907-rwlc4sycqp
-
MD5
d227de4c423a3ac17045fb5ab06900ea
-
SHA1
039c71730038a873242c3b6ffec0fd1749506e56
-
SHA256
f2ad8cd79b80ae7a5dffc6c82628b67e06a5406acaeb0a8c00875a3b66a6aba5
-
SHA512
6a148481a3348fb580daa8639e1246a5a215d23af942c911da473ee3a94a51e04af2058a484f708b2e16ff1f87b116a703152ee886b37203979a81511c0ca7d4
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlX:86SIROiFJiwp0xlrlX
Behavioral task
behavioral1
Sample
d227de4c423a3ac17045fb5ab06900ea_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
d227de4c423a3ac17045fb5ab06900ea_JaffaCakes118
-
Size
2.6MB
-
MD5
d227de4c423a3ac17045fb5ab06900ea
-
SHA1
039c71730038a873242c3b6ffec0fd1749506e56
-
SHA256
f2ad8cd79b80ae7a5dffc6c82628b67e06a5406acaeb0a8c00875a3b66a6aba5
-
SHA512
6a148481a3348fb580daa8639e1246a5a215d23af942c911da473ee3a94a51e04af2058a484f708b2e16ff1f87b116a703152ee886b37203979a81511c0ca7d4
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlX:86SIROiFJiwp0xlrlX
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4