Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118
-
Size
3.6MB
-
Sample
240914-lyr1saxhrm
-
MD5
dff4e37cf62c0888e24b9a30027e9ea0
-
SHA1
f9e2b59eec5d37040b554b9558e07990108f0284
-
SHA256
e88c6927e4925cd19399a7821a112da7a9450669ac88669a349ab0e9607db097
-
SHA512
63b8585dd1fa55e098e4755ed3146f42be329ded9fd54f41aec162b73b6edd539393e2da0947a92faac3182eb5fad9d8254a7403831f023f52294c8f742db25b
-
SSDEEP
98304:TKTKPWZZqUPpu6PidhnNtwtv2Uk1uM02ZZM5+3:T48WeUA6aAt2UBP+3
Static task
static1
Behavioral task
behavioral1
Sample
dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118
-
Size
3.6MB
-
MD5
dff4e37cf62c0888e24b9a30027e9ea0
-
SHA1
f9e2b59eec5d37040b554b9558e07990108f0284
-
SHA256
e88c6927e4925cd19399a7821a112da7a9450669ac88669a349ab0e9607db097
-
SHA512
63b8585dd1fa55e098e4755ed3146f42be329ded9fd54f41aec162b73b6edd539393e2da0947a92faac3182eb5fad9d8254a7403831f023f52294c8f742db25b
-
SSDEEP
98304:TKTKPWZZqUPpu6PidhnNtwtv2Uk1uM02ZZM5+3:T48WeUA6aAt2UBP+3
-
Modifies Windows Firewall
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1