Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    df9f83686c697a68d57f5983d39f52ee_JaffaCakes118

  • Size

    556KB

  • Sample

    240914-gtk98azgle

  • MD5

    df9f83686c697a68d57f5983d39f52ee

  • SHA1

    46ae2d9fa980e492d59f67ed20ab0803c05d81ea

  • SHA256

    53bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c

  • SHA512

    47a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482

  • SSDEEP

    6144:lj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:t6onxOp8FySpE5zvIdtU+Ymef

Malware Config

Targets

    • Target

      df9f83686c697a68d57f5983d39f52ee_JaffaCakes118

    • Size

      556KB

    • MD5

      df9f83686c697a68d57f5983d39f52ee

    • SHA1

      46ae2d9fa980e492d59f67ed20ab0803c05d81ea

    • SHA256

      53bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c

    • SHA512

      47a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482

    • SSDEEP

      6144:lj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:t6onxOp8FySpE5zvIdtU+Ymef

    • Modifies WinLogon for persistence

    • UAC bypass

    • Adds policy Run key to start application

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks