Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ebbf1996af383d36b1323cf76461329c_JaffaCakes118
-
Size
1.0MB
-
Sample
240919-t3tzyayhjk
-
MD5
ebbf1996af383d36b1323cf76461329c
-
SHA1
8dbbdc597609a7917d15d5c061448753d178cb54
-
SHA256
3179281183ff1283cb1e9f9228403e8473a8a65b8cba04efd067a209d816d082
-
SHA512
e8694586bcad20d484f63086d2499b9fead1e738f6437e60d7674ff3fd915ea9f932fb621b515e418339e3f6154a5eab5f76a81b17acd7c9a7e9e0f8540c70db
-
SSDEEP
24576:Gj2xBxbQqRR3OCCUotq0YjLRhmFatzuWBR0JPV0GeKG:GjwTQYs30Jj9cFeyeREPmG7G
Static task
static1
Behavioral task
behavioral1
Sample
ebbf1996af383d36b1323cf76461329c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebbf1996af383d36b1323cf76461329c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
ebbf1996af383d36b1323cf76461329c_JaffaCakes118
-
Size
1.0MB
-
MD5
ebbf1996af383d36b1323cf76461329c
-
SHA1
8dbbdc597609a7917d15d5c061448753d178cb54
-
SHA256
3179281183ff1283cb1e9f9228403e8473a8a65b8cba04efd067a209d816d082
-
SHA512
e8694586bcad20d484f63086d2499b9fead1e738f6437e60d7674ff3fd915ea9f932fb621b515e418339e3f6154a5eab5f76a81b17acd7c9a7e9e0f8540c70db
-
SSDEEP
24576:Gj2xBxbQqRR3OCCUotq0YjLRhmFatzuWBR0JPV0GeKG:GjwTQYs30Jj9cFeyeREPmG7G
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1