Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    eb4e2a8e3747a92bfa9eddbd82922e59_JaffaCakes118

  • Size

    2.0MB

  • Sample

    240919-pbh15sxdrg

  • MD5

    eb4e2a8e3747a92bfa9eddbd82922e59

  • SHA1

    edb4309be523ffcc63d959bd5e9bbf60d4745c32

  • SHA256

    5be56a365a6205f79afd477feefbfc72b780440f1771df21efe634aa39e2e6d2

  • SHA512

    2f452c17fb730dcb95f4b72a665585f5bf227e09f49b05aeff447f47e77c4d59d1f973d19ef990b6fe3a6b7f1910a9beaf3d128e6ffe2e113c142c6309afdaaa

  • SSDEEP

    49152:DMqDXya6MmXveHhW7NmmsvMdAdg5G7Td7uDEpafagvYqiKneu:D9YMhhWIVvMdAio7uwpaigvpeu

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=2&2=1&3=33&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=udcwtuujnm&14=1

Extracted

Language
hta
Source
URLs
hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=2&2=1&3=33&4=i&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000&12=gxqrnapdoe&14=1

Targets

    • Target

      eb4e2a8e3747a92bfa9eddbd82922e59_JaffaCakes118

    • Size

      2.0MB

    • MD5

      eb4e2a8e3747a92bfa9eddbd82922e59

    • SHA1

      edb4309be523ffcc63d959bd5e9bbf60d4745c32

    • SHA256

      5be56a365a6205f79afd477feefbfc72b780440f1771df21efe634aa39e2e6d2

    • SHA512

      2f452c17fb730dcb95f4b72a665585f5bf227e09f49b05aeff447f47e77c4d59d1f973d19ef990b6fe3a6b7f1910a9beaf3d128e6ffe2e113c142c6309afdaaa

    • SSDEEP

      49152:DMqDXya6MmXveHhW7NmmsvMdAdg5G7Td7uDEpafagvYqiKneu:D9YMhhWIVvMdAio7uwpaigvpeu

    • Disables service(s)

    • UAC bypass

    • Disables taskbar notifications via registry modification

    • Event Triggered Execution: Image File Execution Options Injection

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks