Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118
-
Size
163KB
-
Sample
240912-3g6w2s1erk
-
MD5
dd3ce8dbf0a47cc0f8e79674e94ea0b2
-
SHA1
d57a1fea678d6f2d90f970a18ac28cadef00e453
-
SHA256
f1e0924d922cf0a152c235418798e6b84cba8382142b29bdeb36a6919d7c2636
-
SHA512
41df0d9f2962f14c8b501c8e9bb2ef34f9f31d5595bdc18f5020e2f3933d9917923ad8e10b1d2781a64117b592e7ab3abd9f838719fa6219360e97ba0af5a1b2
-
SSDEEP
3072:jD6k69gPuAyEmiuqyaq7nRkWm5yyIw2z2MYCgN5fQjJKeYphEh5oX3Ya26KLiO9:X6klmAyEmiuqFq2P5yyIw2zECYRQlKe/
Static task
static1
Behavioral task
behavioral1
Sample
dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
dd3ce8dbf0a47cc0f8e79674e94ea0b2_JaffaCakes118
-
Size
163KB
-
MD5
dd3ce8dbf0a47cc0f8e79674e94ea0b2
-
SHA1
d57a1fea678d6f2d90f970a18ac28cadef00e453
-
SHA256
f1e0924d922cf0a152c235418798e6b84cba8382142b29bdeb36a6919d7c2636
-
SHA512
41df0d9f2962f14c8b501c8e9bb2ef34f9f31d5595bdc18f5020e2f3933d9917923ad8e10b1d2781a64117b592e7ab3abd9f838719fa6219360e97ba0af5a1b2
-
SSDEEP
3072:jD6k69gPuAyEmiuqyaq7nRkWm5yyIw2z2MYCgN5fQjJKeYphEh5oX3Ya26KLiO9:X6klmAyEmiuqFq2P5yyIw2zECYRQlKe/
-
Creates new service(s)
-
Server Software Component: Terminal Services DLL
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2