Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dabe00f7f52015eb25ea638bf1789a39_JaffaCakes118

  • Size

    301KB

  • Sample

    240911-tsdj7s1arb

  • MD5

    dabe00f7f52015eb25ea638bf1789a39

  • SHA1

    19c289352343f0bd8dc92d793c76c1916951eb31

  • SHA256

    d1e36cd9773325cc05b50a0b5e9354138fa725f47186263804185fa0b5383cae

  • SHA512

    d8a2531c71e142005e7d293e64a66b6b8f75e1e6ec1e9e79a6d15feccb954abcd61b2da52f82d14329f388cac1397b90fe6a1dc0a062d5cbde56ca86dd2a71e1

  • SSDEEP

    6144:NOIvzB25lgNXGiw4ucE6IWY/TY41KTwwR2mI/s:NOgt25uQiw4uj6IY4YTwwkU

Malware Config

Targets

    • Target

      dabe00f7f52015eb25ea638bf1789a39_JaffaCakes118

    • Size

      301KB

    • MD5

      dabe00f7f52015eb25ea638bf1789a39

    • SHA1

      19c289352343f0bd8dc92d793c76c1916951eb31

    • SHA256

      d1e36cd9773325cc05b50a0b5e9354138fa725f47186263804185fa0b5383cae

    • SHA512

      d8a2531c71e142005e7d293e64a66b6b8f75e1e6ec1e9e79a6d15feccb954abcd61b2da52f82d14329f388cac1397b90fe6a1dc0a062d5cbde56ca86dd2a71e1

    • SSDEEP

      6144:NOIvzB25lgNXGiw4ucE6IWY/TY41KTwwR2mI/s:NOgt25uQiw4uj6IY4YTwwkU

    • Adds policy Run key to start application

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks