Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118

  • Size

    327KB

  • Sample

    240921-v3clbsvckk

  • MD5

    f04c346d3404ac8d43e5d0a53ddade9c

  • SHA1

    fe67d3fa2e6f7cba1ddecbd602c85f6afeba3ea0

  • SHA256

    687e462b8258737846dbd465a671aa54445a0d04b8806e7038bf115715d4b6c0

  • SHA512

    85485992f4b956618496d771f0182ee4206176658d558c706536f07c629ba398eb08dc51e905bfbfae4dad8f644c5d586a82bae37ac6f3c508019b2ddf87fbc4

  • SSDEEP

    6144:O5b5+cPq+OP1J1Dtcc+RBaCdgmCtj0qJifmgYHLgiJ8+KqICY6oHW9k1UJADkau:O15+cS+2b1pcfZU4fmgYH7J8+GtvzDu

Malware Config

Targets

    • Target

      f04c346d3404ac8d43e5d0a53ddade9c_JaffaCakes118

    • Size

      327KB

    • MD5

      f04c346d3404ac8d43e5d0a53ddade9c

    • SHA1

      fe67d3fa2e6f7cba1ddecbd602c85f6afeba3ea0

    • SHA256

      687e462b8258737846dbd465a671aa54445a0d04b8806e7038bf115715d4b6c0

    • SHA512

      85485992f4b956618496d771f0182ee4206176658d558c706536f07c629ba398eb08dc51e905bfbfae4dad8f644c5d586a82bae37ac6f3c508019b2ddf87fbc4

    • SSDEEP

      6144:O5b5+cPq+OP1J1Dtcc+RBaCdgmCtj0qJifmgYHLgiJ8+KqICY6oHW9k1UJADkau:O15+cS+2b1pcfZU4fmgYH7J8+GtvzDu

    • Event Triggered Execution: Image File Execution Options Injection

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: Clear Persistence

      remove IFEO.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.