Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ec6bc1f7df8d0b6ce009def51eefb65c_JaffaCakes118
-
Size
2.6MB
-
Sample
240919-3s2rgaxhkq
-
MD5
ec6bc1f7df8d0b6ce009def51eefb65c
-
SHA1
47f7169b1c9600b86dc3fa8a4a2e61b466b78e43
-
SHA256
7054bee4934aa720fad87e6c5180853135b95ccd9aeaa3ef6a0c79d770ff843a
-
SHA512
7487b0fe6d6a987dc11c51cf7601f9936ec4e09916d5ad07bbe873b503a2ebbc6c2950d5dd3e7573ef19788c6ec4c21417851cdc3b6a040eca7b895f167fec04
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl7:86SIROiFJiwp0xlrl7
Behavioral task
behavioral1
Sample
ec6bc1f7df8d0b6ce009def51eefb65c_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
ec6bc1f7df8d0b6ce009def51eefb65c_JaffaCakes118
-
Size
2.6MB
-
MD5
ec6bc1f7df8d0b6ce009def51eefb65c
-
SHA1
47f7169b1c9600b86dc3fa8a4a2e61b466b78e43
-
SHA256
7054bee4934aa720fad87e6c5180853135b95ccd9aeaa3ef6a0c79d770ff843a
-
SHA512
7487b0fe6d6a987dc11c51cf7601f9936ec4e09916d5ad07bbe873b503a2ebbc6c2950d5dd3e7573ef19788c6ec4c21417851cdc3b6a040eca7b895f167fec04
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl7:86SIROiFJiwp0xlrl7
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4