Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

da9aa96c96...18.exe

windows7-x64

7

da9aa96c96...18.exe

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ps.dll

windows7-x64

3

$PLUGINSDI...ps.dll

windows10-2004-x64

3

1314.exe

windows7-x64

3

1314.exe

windows10-2004-x64

3

$PROGRAM_F...rX.dll

windows7-x64

7

$PROGRAM_F...rX.dll

windows10-2004-x64

7

$PROGRAM_F...ce.exe

windows7-x64

3

$PROGRAM_F...ce.exe

windows10-2004-x64

3

gpupdate.exe

windows7-x64

3

gpupdate.exe

windows10-2004-x64

3

ipseccmd.exe

windows7-x64

3

ipseccmd.exe

windows10-2004-x64

3

polstore.dll

windows7-x64

3

polstore.dll

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

winipsec.dll

windows7-x64

3

winipsec.dll

windows10-2004-x64

3

ܾ�...��.bat

windows7-x64

3

ܾ�...��.bat

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da9aa96c9630ec4e6d3afac19baac2f0_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240911-sefxqsxdqc

  • MD5

    da9aa96c9630ec4e6d3afac19baac2f0

  • SHA1

    4215e5ed9f8bc1be227788f5e23c9ee488290ac5

  • SHA256

    81e9fdae84f8ab3f326927f01990390588c68c890f3630547c7960c6cc1906f7

  • SHA512

    40a5f9c755132167d1a591e90ee5c6a15bcc93d529ae011a4724ddb77b4d6df987bfed0facf7fadfdc60f5572085e3e0bf380dd57bb645d951aa2066311ff6b6

  • SSDEEP

    24576:/FlPiET3JkuWPPCIwyUbLFMbDJx21PC8tqj7jRXxT5oH:/niET3Jku0qpbLFMbDJSPx27XmH

Score
7/10
adwarebootkitdiscoverypersistencestealer

Malware Config

Targets

    • Target

      da9aa96c9630ec4e6d3afac19baac2f0_JaffaCakes118

    • Size

      1.2MB

    • MD5

      da9aa96c9630ec4e6d3afac19baac2f0

    • SHA1

      4215e5ed9f8bc1be227788f5e23c9ee488290ac5

    • SHA256

      81e9fdae84f8ab3f326927f01990390588c68c890f3630547c7960c6cc1906f7

    • SHA512

      40a5f9c755132167d1a591e90ee5c6a15bcc93d529ae011a4724ddb77b4d6df987bfed0facf7fadfdc60f5572085e3e0bf380dd57bb645d951aa2066311ff6b6

    • SSDEEP

      24576:/FlPiET3JkuWPPCIwyUbLFMbDJx21PC8tqj7jRXxT5oH:/niET3Jku0qpbLFMbDJSPx27XmH

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/BrandingURL.dll

    • Size

      3KB

    • MD5

      9c3488b5e9655d1837c3963ecec33f70

    • SHA1

      f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

    • SHA256

      05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

    • SHA512

      6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      b18dfaded8f6d2380fdfd8f6b6969211

    • SHA1

      969fa0e906240ab1123254feeb833c275626cf76

    • SHA256

      747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58

    • SHA512

      25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c

    • SSDEEP

      192:66JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTLK72dwF7dBdcQOz:66JaVh4I5rpPbTL+BdhO

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      9b17a13f814b137f88b961c087858063

    • SHA1

      c290dd3139b79aa340aec3ed3d674160433035e1

    • SHA256

      e54792a179a06acbb9b69c117ee804dce070505d1853d6e7d512f2a055a801b2

    • SHA512

      3a625f5f13e344c24973c79c074d1ced4d9206f87f392dc7c8f0c116d0f2b878b60340e2377d0240c47f0e34e25e4e3af8b196bbca1c6a29a0f51d8408e8b0ec

    • SSDEEP

      48:SnNQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJcABofgMGKO:Bz+MM4eqmvz0JScx56mpwzAhWcGV

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      810f3a0aefe36a9f63e29e604bea91a9

    • SHA1

      2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80

    • SHA256

      f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779

    • SHA512

      836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb

    • SSDEEP

      192:CO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1argMO:XKAFERdlxhGRYUzqZar

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/ToolTips.dll

    • Size

      4KB

    • MD5

      9a0da2692764bb842411a8b9687ebbb7

    • SHA1

      5c3a459faa08a704bdf162476897ad4580ae39bd

    • SHA256

      28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb

    • SHA512

      814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed

    • SSDEEP

      48:apm2+v7BWCLWQqLa7JZ0ZK59HXesxdrqZZSakw6/K:Ymjv7BWoTicJZ0ZKPHXVx1MOw6

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      1314.exe

    • Size

      950KB

    • MD5

      c8129f57a711cfb7ad22ba693307a112

    • SHA1

      863d65c76b9e43df05e8e09641500226173932a0

    • SHA256

      9973e5e35595b747287496734a7d9949d65fbc345916bf3b73a1810e8e5e619b

    • SHA512

      6db6ab026ee8c4a590872592c0a8dfd87361b0d9e9f1fc4844566df6d61180f6ba147ce17634e287ae5b8f5e7582db0a400d358dd10ec2019f7c32dbebefa7f9

    • SSDEEP

      24576:mSrkwCIlu4ZpVmN6Ar47326LSmDfF8173yGXzFHPWdp:mckwCIYOKsGcSaFe39zQ3

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll

    • Size

      2.5MB

    • MD5

      cb1132c968e9d4a24da771898fcf0eb7

    • SHA1

      bf1ca78a957188d505b5d2a3fe8db783a288f633

    • SHA256

      3e6cce5b9fe0f66885d10e4a1f3f7ce7cd751f832cb50975252d60ffe95f266f

    • SHA512

      cd917d60b453c702a1be7aef4e2f9852332965be5a0f0c85fcf83192e6434f9ee9c612bc0d92101e11d4ac513b73334852fb630850f6788a21dac0327823913d

    • SSDEEP

      49152:L+oBkJlCkfUp/VF2tePHKH9sM0ibYXX1Dq:LZ6xfU5VF20OKC

    Score
    7/10
    adwarebootkitdiscoverypersistencestealer

    • Loads dropped DLL

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral15behavioral16

    • Target

      $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduService.exe

    • Size

      155KB

    • MD5

      7f5480c87223ee42dc8dd9d096730d10

    • SHA1

      221f7674be7e3de8fd18219300b0f09c627a14e2

    • SHA256

      6a2c57497b4aa640ed66de0278ab61592bb39ebc9cea55f90a31379c489f9484

    • SHA512

      f34653cea1f0d9a68a9f58fd37f17735a8702093dc9655471bc28aaed0229a024485c02ec5d46280b03da6e277193d19c2b46b98286d916e4bdcc48bbfe8da9e

    • SSDEEP

      3072:UH15+DMcNSNgG85IR2snGgCabN2bsMHAzAaJz9XdEal:UV5+XUYhIJ2oLEal

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      gpupdate.exe

    • Size

      66KB

    • MD5

      9505bd2a77802883720f92691fb30b95

    • SHA1

      6c83b8e46291d9f7697817341a8b83627447d90d

    • SHA256

      3f35ae66c1f58009b2e3c261c6720f4c8a2163c29cac428f776459c927c3c2cf

    • SHA512

      2004b0a3e42819f353a8c7f2b253ab57a7346d0752016c8aa32389fb88f59dafefaf51233c93cf4729240f64ab5bacc96d48b9cddd61da40fc077da122ed0316

    • SSDEEP

      1536:h1ka8pvqib2B1d36sY/PywqUWNb0YldTx7X/zq:h1puie2/h6sPqYldTx7X/zq

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      ipseccmd.exe

    • Size

      70KB

    • MD5

      d6abe3e358699ea7e8fb43e7e107b130

    • SHA1

      a270c552cbbdfb7d22ca1df69ebc46f336265435

    • SHA256

      020ef5ec6bc9eff7bbd0f31b2c6946b5f20e4664787d5fa492cd60c14ed0f326

    • SHA512

      be1b7c94095ea8615fd624ea25ddfc6180434fc4fb338f7120c99039e9acad63181f769f3d80a6ad3d765668dc8fed8eed59cac4a8f60ee875d482fbb5a7b91d

    • SSDEEP

      1536:i5+JR0wQaD5fOBjM0S3B3h1WgJgJa5OzmT10xoPPW:n5OBOhJIzLsO

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      polstore.dll

    • Size

      85KB

    • MD5

      6ba228caa2c5ba37b3944a775f15dfaa

    • SHA1

      a4d18a91ec4b9267b7b21259366ef9fb604d76df

    • SHA256

      7b0a9441bc9cc6f9df73bb6a75ebe657ec0a9abccd08d318f6e388f9240015d4

    • SHA512

      df0ae65942a863a8450991a19f1cbb008a34ac1f06a236ea41a38c1b6f48732235bd32423f16eb06f0678e051d2f024d3f98b9d42590a511c761747261d700a9

    • SSDEEP

      1536:2nGUwSifySaSnYiS3CpoZzsI5icYel92YcNqAyVy30TEhcEGFt7wt:cGbSsa5i3abLckAUyEecEE7

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      uninst.exe

    • Size

      69KB

    • MD5

      9dcd2d76c51dba028175f3007fc3e2a5

    • SHA1

      011345e99f57c6bf61ec72dc3490dd5230be7e09

    • SHA256

      410ed40e4758cb2c9f5c045e53aea79dd29b3096f2c9bb9b6ae1e0cfaf4d7065

    • SHA512

      63b1fb01d07c26101a0eac63cadd4057011f8bf58adf00cc434a15f41695cc46821fe611f6451b12625b7b909de1f289580a034e5aa72dad7df85d1619ed401b

    • SSDEEP

      1536:qRhoEXBpnbfRpQmJ2kg0eV6/apOfYSSIg3XTsJLYKA:qjJ7nbppQmJ2kpxUOfeIg3XTsJsKA

    Score
    7/10
    discovery

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral25behavioral26

    • Target

      $PLUGINSDIR/FindProcDLL.dll

    • Size

      31KB

    • MD5

      83cd62eab980e3d64c131799608c8371

    • SHA1

      5b57a6842a154997e31fab573c5754b358f5dd1c

    • SHA256

      a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

    • SHA512

      91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

    • SSDEEP

      384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      winipsec.dll

    • Size

      25KB

    • MD5

      c7fed0535f28d80cb220091b9b0bdf3a

    • SHA1

      d9ccbb93974bf87c2c65d7d3c429d84d2a9b8aa3

    • SHA256

      629b502af65a1e08b6601fb9b6399d5bb9ba3f3734950fae1f699cf66ac68cae

    • SHA512

      55967632d51f7bd3cae5ba22872fc0d8fb1cfac6692ab91a1a08fa4d352756ef7f36aea4e00f4a2542a0e572b4738fdc0b6ce89ba0147df79700a9b41983ed8c

    • SSDEEP

      384:uQwN7GLBQ/eySOmRo9nJ+mYaF7c9h6HlT0+RN6kZGyhtdu41QEHqnmQhuIZwLMqC:1Q8Nh0NZGyhtg4mEoYuPlEGH

    Score
    3/10
    discovery
    behavioral29behavioral30

    • Target

      ܾ˿˲.bat

    • Size

      47KB

    • MD5

      25aa3b4fe6817cad8ab174d6fbbf89c5

    • SHA1

      2f991387bab6ae8bb8d6e329fe9f8e5ca037aaa9

    • SHA256

      6ebfd09383073c4e4699fa90de19d47a0e2778ec6c363534af7840a85ea2939e

    • SHA512

      35d19b1ec89019dccf097f2c7694c7b1f2326809a65895cda65446bfff13f9175a0b28ad3c74c73d0b2585b6b992097c587f3060b30cc63f9cb4e145df36a083

    • SSDEEP

      768:+2Tbv2+ZWnrUeVRrSv1CP7V3+6acRGhujJ3TDkYTByayPEapZwB9D1X3YqSlNFSI:+2Tbv2+ZWnrUeVRrSv1CP7V3+6acRGhj

    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

adwarebootkitdiscoverypersistencestealer
Score
7/10

behavioral16

adwarebootkitdiscoverypersistencestealer
Score
7/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
7/10

behavioral26

discovery
Score
7/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10