Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118

  • Size

    524KB

  • Sample

    240927-thbmvszgkm

  • MD5

    fab71c58e9f2c32d021b4c8ef260100d

  • SHA1

    dfb8a221acfbe8d35da0c6bcee24a1e154e128a3

  • SHA256

    7710ace40fe233fce6e18c968719413b757ac496f8f8711c2e377a8c22b1831d

  • SHA512

    5ffb049311264b6513e53044940c2aa10ad68f73e4dbbdaea5b57fe44c642861745d8c3aa757a0dd24f93c51afd171ad3ce5b9308b807cfd4a6bb880683a9b7e

  • SSDEEP

    12288:MSFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:jF+u+gkX3o1jSkErM2

Malware Config

Targets

    • Target

      fab71c58e9f2c32d021b4c8ef260100d_JaffaCakes118

    • Size

      524KB

    • MD5

      fab71c58e9f2c32d021b4c8ef260100d

    • SHA1

      dfb8a221acfbe8d35da0c6bcee24a1e154e128a3

    • SHA256

      7710ace40fe233fce6e18c968719413b757ac496f8f8711c2e377a8c22b1831d

    • SHA512

      5ffb049311264b6513e53044940c2aa10ad68f73e4dbbdaea5b57fe44c642861745d8c3aa757a0dd24f93c51afd171ad3ce5b9308b807cfd4a6bb880683a9b7e

    • SSDEEP

      12288:MSFMFpuhRp8tmnkX4C4IosE/rSkU19Zt/kMM22:jF+u+gkX3o1jSkErM2

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates processes with tasklist

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks