Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
eabd3adb848cfe1843879142be96a2d7_JaffaCakes118
-
Size
2.3MB
-
Sample
240919-gy4x5avarf
-
MD5
eabd3adb848cfe1843879142be96a2d7
-
SHA1
8843f2b3e152add67c33f894d2456906ab4a3629
-
SHA256
4c66076782018ccb966e7a509acb60d4c921a2bdcd86b2e385ab0362b570ef8b
-
SHA512
411d35c02b7a814b2c96d7a4904c0c889f4c0aeda0e253370c09d632f12fdbe44ee310129851f363a4a1b83a0e99aa1ae890df81aa8be5e7355722a6479106e8
-
SSDEEP
49152:e1ZWlkS3CWK0HieQs9QToFxQP09R4lPQ2r1CsHrpNxO8:e6lkS3Npirs2TAx5SNQA0kpy8
Static task
static1
Behavioral task
behavioral1
Sample
eabd3adb848cfe1843879142be96a2d7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eabd3adb848cfe1843879142be96a2d7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
http://soft-store-inc.com/soft-usage/favicon.ico?0=1200&1=WOUOSVRD&2=i-s&3=72&4=7601&5=6&6=1&7=99600&8=1033
Extracted
http://soft-store-inc.com/soft-usage/favicon.ico?0=1200&1=MKDTRXIT&2=i-s&3=72&4=9200&5=6&6=2&7=919041&8=1033
Targets
-
-
Target
eabd3adb848cfe1843879142be96a2d7_JaffaCakes118
-
Size
2.3MB
-
MD5
eabd3adb848cfe1843879142be96a2d7
-
SHA1
8843f2b3e152add67c33f894d2456906ab4a3629
-
SHA256
4c66076782018ccb966e7a509acb60d4c921a2bdcd86b2e385ab0362b570ef8b
-
SHA512
411d35c02b7a814b2c96d7a4904c0c889f4c0aeda0e253370c09d632f12fdbe44ee310129851f363a4a1b83a0e99aa1ae890df81aa8be5e7355722a6479106e8
-
SSDEEP
49152:e1ZWlkS3CWK0HieQs9QToFxQP09R4lPQ2r1CsHrpNxO8:e6lkS3Npirs2TAx5SNQA0kpy8
-
Modifies WinLogon for persistence
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
2