Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
da7013f9b484dfde31a6651d33169d43_JaffaCakes118
-
Size
140KB
-
Sample
240911-qnzp4ashpf
-
MD5
da7013f9b484dfde31a6651d33169d43
-
SHA1
9c4968d24cf4899f1a0b6a2d7ee9123becb17dd6
-
SHA256
ca05c8ce6a3a33404b9abc6c77e234a7f8bd2e7e8de1b88ef6087da07a01b6f4
-
SHA512
20e42c6dd1758ce4bd24aba71a0916491d64f45ae7f995aa9d567f0251ef50de02d1e8175d3754d90905ccb36f315104f20fad820a72991c99e802ecb61208e2
-
SSDEEP
1536:y6g37Kf/JToD3BNmjuwIfy+zyF0yqpP/mOoIXWZiMMW4TdHRR1c7G/uX55BMqri2:BS0xToTByhItzfjH9eYW4TdRL/EkRpu
Static task
static1
Behavioral task
behavioral1
Sample
da7013f9b484dfde31a6651d33169d43_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
da7013f9b484dfde31a6651d33169d43_JaffaCakes118
-
Size
140KB
-
MD5
da7013f9b484dfde31a6651d33169d43
-
SHA1
9c4968d24cf4899f1a0b6a2d7ee9123becb17dd6
-
SHA256
ca05c8ce6a3a33404b9abc6c77e234a7f8bd2e7e8de1b88ef6087da07a01b6f4
-
SHA512
20e42c6dd1758ce4bd24aba71a0916491d64f45ae7f995aa9d567f0251ef50de02d1e8175d3754d90905ccb36f315104f20fad820a72991c99e802ecb61208e2
-
SSDEEP
1536:y6g37Kf/JToD3BNmjuwIfy+zyF0yqpP/mOoIXWZiMMW4TdHRR1c7G/uX55BMqri2:BS0xToTByhItzfjH9eYW4TdRL/EkRpu
-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
4