Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dbc24cc44d3682623968b01659fba77c_JaffaCakes118

  • Size

    56KB

  • Sample

    240912-edwd5szdpl

  • MD5

    dbc24cc44d3682623968b01659fba77c

  • SHA1

    38890157e7e892072c2d66c3687c203e1df5523d

  • SHA256

    ea39f5f38bd536757c0f1ec97db474300de7040b3c3f0829d35d4cc8ca140de8

  • SHA512

    9b487798442f98ce92b4933618073d0a6fd7c8c39e65debc8a80e08eb2a182126d6913cb072269c6f2efbfc7647c36a274e0fdcf8485fd41474f6d01040da8aa

  • SSDEEP

    1536:E0nuJ0pmaxxtP8S5y7xcAzzZFQXV8zm6mWY:E0uJ0caxT8A+vzgyzHmH

Malware Config

Targets

    • Target

      dbc24cc44d3682623968b01659fba77c_JaffaCakes118

    • Size

      56KB

    • MD5

      dbc24cc44d3682623968b01659fba77c

    • SHA1

      38890157e7e892072c2d66c3687c203e1df5523d

    • SHA256

      ea39f5f38bd536757c0f1ec97db474300de7040b3c3f0829d35d4cc8ca140de8

    • SHA512

      9b487798442f98ce92b4933618073d0a6fd7c8c39e65debc8a80e08eb2a182126d6913cb072269c6f2efbfc7647c36a274e0fdcf8485fd41474f6d01040da8aa

    • SSDEEP

      1536:E0nuJ0pmaxxtP8S5y7xcAzzZFQXV8zm6mWY:E0uJ0caxT8A+vzgyzHmH

    • Disables service(s)

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks