Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ecab5f38df1bf3566db24a6227dfd189_JaffaCakes118
-
Size
2.6MB
-
Sample
240920-cz2f6stgrf
-
MD5
ecab5f38df1bf3566db24a6227dfd189
-
SHA1
c84737f0d05ac83ed833b7ace77b351d0b9b6491
-
SHA256
b6277ae75add6a3e9a064ee95fc3a8adc7981528da476b3c9aadadce57fd3ba5
-
SHA512
4b7bb7dcb474206ffd200c5092118c6a79848112d42c7ffcdc29d7e7301d828f4139732831a0bbf61b78c8440d4a17d729717c63c802e0869704a64383de6892
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlQ:86SIROiFJiwp0xlrlQ
Behavioral task
behavioral1
Sample
ecab5f38df1bf3566db24a6227dfd189_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Targets
-
-
Target
ecab5f38df1bf3566db24a6227dfd189_JaffaCakes118
-
Size
2.6MB
-
MD5
ecab5f38df1bf3566db24a6227dfd189
-
SHA1
c84737f0d05ac83ed833b7ace77b351d0b9b6491
-
SHA256
b6277ae75add6a3e9a064ee95fc3a8adc7981528da476b3c9aadadce57fd3ba5
-
SHA512
4b7bb7dcb474206ffd200c5092118c6a79848112d42c7ffcdc29d7e7301d828f4139732831a0bbf61b78c8440d4a17d729717c63c802e0869704a64383de6892
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlQ:86SIROiFJiwp0xlrlQ
-
Modifies WinLogon for persistence
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4