Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118
-
Size
172KB
-
Sample
240914-wr28aayanf
-
MD5
e0bf188e12e4a5e6fa88fa53dd25d2d2
-
SHA1
1edd4b1f4a6b81bc579c61ac4189321e56be1734
-
SHA256
72a82a566eb7c23d1e42f21e522a5200e0689ee2c9d56737b57b311224c57c82
-
SHA512
df167654d6fdbdcd900cd0f6d76cac89202045dfcfb82bc6e2c65b1799acef4c1bbd65b27483b60f5afbed6404fc11d5384cf15cfa8d665a5a0a8f5547f64cd2
-
SSDEEP
3072:xKBCqWyB9ORAfKdw5rXu0tVWe/ocgo1PIWckX+V1g3sWDE:xEB9O+T1PVWe/RNPIe+ris
Static task
static1
Behavioral task
behavioral1
Sample
e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
e0bf188e12e4a5e6fa88fa53dd25d2d2_JaffaCakes118
-
Size
172KB
-
MD5
e0bf188e12e4a5e6fa88fa53dd25d2d2
-
SHA1
1edd4b1f4a6b81bc579c61ac4189321e56be1734
-
SHA256
72a82a566eb7c23d1e42f21e522a5200e0689ee2c9d56737b57b311224c57c82
-
SHA512
df167654d6fdbdcd900cd0f6d76cac89202045dfcfb82bc6e2c65b1799acef4c1bbd65b27483b60f5afbed6404fc11d5384cf15cfa8d665a5a0a8f5547f64cd2
-
SSDEEP
3072:xKBCqWyB9ORAfKdw5rXu0tVWe/ocgo1PIWckX+V1g3sWDE:xEB9O+T1PVWe/RNPIe+ris
Score7/10-
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-