Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fa194653ada608d5c37145813acd5715_JaffaCakes118

  • Size

    512KB

  • Sample

    240927-ktswvaxdpe

  • MD5

    fa194653ada608d5c37145813acd5715

  • SHA1

    7992964158202ed0a5a68cf970f8a8619dfaa87c

  • SHA256

    08c3c75b93f5ff45351e8f2ba9f4af4d7b13cb65093128065c08ed53933dc564

  • SHA512

    ce1a0974ff4f009a3fd5cd0bf3907a3fa2e5e6a81af13ba39486f489868ca65412ed064b383bcf6a853e93d98d490fcae3e9f008513e38e47e795761658a3928

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

Malware Config

Targets

    • Target

      fa194653ada608d5c37145813acd5715_JaffaCakes118

    • Size

      512KB

    • MD5

      fa194653ada608d5c37145813acd5715

    • SHA1

      7992964158202ed0a5a68cf970f8a8619dfaa87c

    • SHA256

      08c3c75b93f5ff45351e8f2ba9f4af4d7b13cb65093128065c08ed53933dc564

    • SHA512

      ce1a0974ff4f009a3fd5cd0bf3907a3fa2e5e6a81af13ba39486f489868ca65412ed064b383bcf6a853e93d98d490fcae3e9f008513e38e47e795761658a3928

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks