Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118
-
Size
327KB
-
Sample
240921-v3clbsvckk
-
MD5
f04c346d3404ac8d43e5d0a53ddade9c
-
SHA1
fe67d3fa2e6f7cba1ddecbd602c85f6afeba3ea0
-
SHA256
687e462b8258737846dbd465a671aa54445a0d04b8806e7038bf115715d4b6c0
-
SHA512
85485992f4b956618496d771f0182ee4206176658d558c706536f07c629ba398eb08dc51e905bfbfae4dad8f644c5d586a82bae37ac6f3c508019b2ddf87fbc4
-
SSDEEP
6144:O5b5+cPq+OP1J1Dtcc+RBaCdgmCtj0qJifmgYHLgiJ8+KqICY6oHW9k1UJADkau:O15+cS+2b1pcfZU4fmgYH7J8+GtvzDu
Static task
static1
Behavioral task
behavioral1
Sample
f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118
-
Size
327KB
-
MD5
f04c346d3404ac8d43e5d0a53ddade9c
-
SHA1
fe67d3fa2e6f7cba1ddecbd602c85f6afeba3ea0
-
SHA256
687e462b8258737846dbd465a671aa54445a0d04b8806e7038bf115715d4b6c0
-
SHA512
85485992f4b956618496d771f0182ee4206176658d558c706536f07c629ba398eb08dc51e905bfbfae4dad8f644c5d586a82bae37ac6f3c508019b2ddf87fbc4
-
SSDEEP
6144:O5b5+cPq+OP1J1Dtcc+RBaCdgmCtj0qJifmgYHLgiJ8+KqICY6oHW9k1UJADkau:O15+cS+2b1pcfZU4fmgYH7J8+GtvzDu
-
Event Triggered Execution: Image File Execution Options Injection
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Discovery
Peripheral Device Discovery
1Query Registry
2Remote System Discovery
1Software Discovery
1Security Software Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1