Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
eb814841582bc42cf3e5bca07cd2321b_JaffaCakes118
-
Size
114KB
-
Sample
240919-rkd5natarm
-
MD5
eb814841582bc42cf3e5bca07cd2321b
-
SHA1
699caffc7f4c04dfa3e1cbea88a91c7f4c375800
-
SHA256
6b9b1533a491da60ed65a6b97cd46b7f29e892eb7d3d3ee4479346a94bf973ac
-
SHA512
e16a3e36f5f5fdc5663eb07a8d529aa32e43a5cbf55d6b8110e7289f8f2c9334b4695fccc00ec4563694bbd7adf84a5f672a154cdb597e9c7847ce8541129561
-
SSDEEP
3072:/XAtWYKBlV4mG8D3vQ1owx1Y86mo4+pHxG9:fAoYKXV4ervQ6qaH
Static task
static1
Behavioral task
behavioral1
Sample
eb814841582bc42cf3e5bca07cd2321b_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
pony
http://209.59.216.75/pony/gate.php
http://66.175.212.25/pony/gate.php
-
payload_url
http://alcaponecigarillos.com/RdKtpaU.exe
http://blog.arcelikbayisi.com/cMj.exe
http://omfb.vpsat.be/ped3Hzx5.exe
Targets
-
-
Target
eb814841582bc42cf3e5bca07cd2321b_JaffaCakes118
-
Size
114KB
-
MD5
eb814841582bc42cf3e5bca07cd2321b
-
SHA1
699caffc7f4c04dfa3e1cbea88a91c7f4c375800
-
SHA256
6b9b1533a491da60ed65a6b97cd46b7f29e892eb7d3d3ee4479346a94bf973ac
-
SHA512
e16a3e36f5f5fdc5663eb07a8d529aa32e43a5cbf55d6b8110e7289f8f2c9334b4695fccc00ec4563694bbd7adf84a5f672a154cdb597e9c7847ce8541129561
-
SSDEEP
3072:/XAtWYKBlV4mG8D3vQ1owx1Y86mo4+pHxG9:fAoYKXV4ervQ6qaH
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-