Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118

  • Size

    3.6MB

  • Sample

    240914-lyr1saxhrm

  • MD5

    dff4e37cf62c0888e24b9a30027e9ea0

  • SHA1

    f9e2b59eec5d37040b554b9558e07990108f0284

  • SHA256

    e88c6927e4925cd19399a7821a112da7a9450669ac88669a349ab0e9607db097

  • SHA512

    63b8585dd1fa55e098e4755ed3146f42be329ded9fd54f41aec162b73b6edd539393e2da0947a92faac3182eb5fad9d8254a7403831f023f52294c8f742db25b

  • SSDEEP

    98304:TKTKPWZZqUPpu6PidhnNtwtv2Uk1uM02ZZM5+3:T48WeUA6aAt2UBP+3

Malware Config

Targets

    • Target

      dff4e37cf62c0888e24b9a30027e9ea0_JaffaCakes118

    • Size

      3.6MB

    • MD5

      dff4e37cf62c0888e24b9a30027e9ea0

    • SHA1

      f9e2b59eec5d37040b554b9558e07990108f0284

    • SHA256

      e88c6927e4925cd19399a7821a112da7a9450669ac88669a349ab0e9607db097

    • SHA512

      63b8585dd1fa55e098e4755ed3146f42be329ded9fd54f41aec162b73b6edd539393e2da0947a92faac3182eb5fad9d8254a7403831f023f52294c8f742db25b

    • SSDEEP

      98304:TKTKPWZZqUPpu6PidhnNtwtv2Uk1uM02ZZM5+3:T48WeUA6aAt2UBP+3

    • Modifies Windows Firewall

    • Stops running service(s)

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks