Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e0a772e3e650391ab54c92c61881493b_JaffaCakes118
-
Size
1.6MB
-
Sample
240914-vt8bmswcpg
-
MD5
e0a772e3e650391ab54c92c61881493b
-
SHA1
5e1bd9db61a3b240808f7712a67dc2e82648d281
-
SHA256
d878785bc3ca5d1436afbee19bf8e015d52806c22cc15906b8222ca69cf2912f
-
SHA512
03ad7ff09e4208f58e57fe1f94d0869024e13497fbd4194f6c888f7ada78254e0ea8baf079e4c0ce7bfdbb6ab70bc2b721ba9712465ced5beb81a191dc27a6df
-
SSDEEP
49152:kfPq9jchRQzGOJmkx8lxca5CTcOU7m6kE5N:2Po4ESOJmk8rc1AOU7kQ
Static task
static1
Behavioral task
behavioral1
Sample
e0a772e3e650391ab54c92c61881493b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0a772e3e650391ab54c92c61881493b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
http://daa2265a99d3e63e.pc-shieldonline.com/favicon.ico?0=106&1=0&2=1&3=102&4=i-s&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=mnlllpiqaq
Extracted
http://daa2265a99d3e63e.pc-shieldonline.com/favicon.ico?0=106&1=0&2=1&3=102&4=i-s&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=insbhkuiix
Targets
-
-
Target
e0a772e3e650391ab54c92c61881493b_JaffaCakes118
-
Size
1.6MB
-
MD5
e0a772e3e650391ab54c92c61881493b
-
SHA1
5e1bd9db61a3b240808f7712a67dc2e82648d281
-
SHA256
d878785bc3ca5d1436afbee19bf8e015d52806c22cc15906b8222ca69cf2912f
-
SHA512
03ad7ff09e4208f58e57fe1f94d0869024e13497fbd4194f6c888f7ada78254e0ea8baf079e4c0ce7bfdbb6ab70bc2b721ba9712465ced5beb81a191dc27a6df
-
SSDEEP
49152:kfPq9jchRQzGOJmkx8lxca5CTcOU7m6kE5N:2Po4ESOJmk8rc1AOU7kQ
-
Modifies WinLogon for persistence
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
2