Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

de33c32e49...18.exe

windows7-x64

7

de33c32e49...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de33c32e49679dcbf7535f9d8f6438e5_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240913-mhlphaybnf

  • MD5

    de33c32e49679dcbf7535f9d8f6438e5

  • SHA1

    279ccdda6e5070b763f13b5073b0b6d57e1f76a6

  • SHA256

    9c1adee493f59df85a0292d7818bc350ebebb6239cc0f462041e30cd65262ae8

  • SHA512

    016b37c9bd742dbe195b167bbffb4154507063b5b639e4639586f07d13b9672ae4788357aba42491efb8b1355c843f92d5225ed54660bec2689abc7d35323e66

  • SSDEEP

    49152:DpJrno+zuW4JuRNqCgKd8c5x5Mj1lij4r3mYDm35WUah9OWigplV:LL34LN+SiPvpWd9tpl

Score
7/10
discoveryevasionpersistencethemida

Malware Config

Targets

    • Target

      de33c32e49679dcbf7535f9d8f6438e5_JaffaCakes118

    • Size

      1.9MB

    • MD5

      de33c32e49679dcbf7535f9d8f6438e5

    • SHA1

      279ccdda6e5070b763f13b5073b0b6d57e1f76a6

    • SHA256

      9c1adee493f59df85a0292d7818bc350ebebb6239cc0f462041e30cd65262ae8

    • SHA512

      016b37c9bd742dbe195b167bbffb4154507063b5b639e4639586f07d13b9672ae4788357aba42491efb8b1355c843f92d5225ed54660bec2689abc7d35323e66

    • SSDEEP

      49152:DpJrno+zuW4JuRNqCgKd8c5x5Mj1lij4r3mYDm35WUah9OWigplV:LL34LN+SiPvpWd9tpl

    Score
    7/10
    discoveryevasionpersistencethemida

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks