Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

dd3ce8dbf0...18.exe

windows7-x64

8

dd3ce8dbf0...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118

  • Size

    163KB

  • Sample

    240912-3g6w2s1erk

  • MD5

    dd3ce8dbf0a47cc0f8e79674e94ea0b2

  • SHA1

    d57a1fea678d6f2d90f970a18ac28cadef00e453

  • SHA256

    f1e0924d922cf0a152c235418798e6b84cba8382142b29bdeb36a6919d7c2636

  • SHA512

    41df0d9f2962f14c8b501c8e9bb2ef34f9f31d5595bdc18f5020e2f3933d9917923ad8e10b1d2781a64117b592e7ab3abd9f838719fa6219360e97ba0af5a1b2

  • SSDEEP

    3072:jD6k69gPuAyEmiuqyaq7nRkWm5yyIw2z2MYCgN5fQjJKeYphEh5oX3Ya26KLiO9:X6klmAyEmiuqFq2P5yyIw2zECYRQlKe/

Score
8/10
defense_evasiondiscoveryevasionexecutionpersistence

Malware Config

Targets

    • Target

      dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118

    • Size

      163KB

    • MD5

      dd3ce8dbf0a47cc0f8e79674e94ea0b2

    • SHA1

      d57a1fea678d6f2d90f970a18ac28cadef00e453

    • SHA256

      f1e0924d922cf0a152c235418798e6b84cba8382142b29bdeb36a6919d7c2636

    • SHA512

      41df0d9f2962f14c8b501c8e9bb2ef34f9f31d5595bdc18f5020e2f3933d9917923ad8e10b1d2781a64117b592e7ab3abd9f838719fa6219360e97ba0af5a1b2

    • SSDEEP

      3072:jD6k69gPuAyEmiuqyaq7nRkWm5yyIw2z2MYCgN5fQjJKeYphEh5oX3Ya26KLiO9:X6klmAyEmiuqFq2P5yyIw2zECYRQlKe/

    Score
    8/10
    defense_evasiondiscoveryevasionexecutionpersistence

    • Creates new service(s)

      persistenceexecution

    • Modifies service settings

      Alters the configuration of existing services.

      evasion

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks