Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118
-
Size
88KB
-
Sample
240929-vzrk3swhma
-
MD5
ff03d0cd80728b40f25f3b7474416c43
-
SHA1
dc5b6d6810fcd5139a383c8f9d84c81238eaa2ad
-
SHA256
574fffd479b4c36584008a4baa7216d3472cfcc6be36342708898efc3d73a656
-
SHA512
bdc869c1349d45dfaa1a59d2d95f7a75102a8b0053646757c7cd4ec347f15f1fced8df1964c33c0c570deda4415035798921ae98bb034437bb0b80bd3a94ede0
-
SSDEEP
1536:U20UGCrqTwaNzyMnA78OvLUUiAAd7i5tR9uO4zAOeGTvEE6TlkzmCW:d0WOzTnWrzZ0O40OyE6NCW
Behavioral task
behavioral1
Sample
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://aromabiotenical.com.au/wp-admin/css/Panel/gate.php
Targets
-
-
Target
ff03d0cd80728b40f25f3b7474416c43_JaffaCakes118
-
Size
88KB
-
MD5
ff03d0cd80728b40f25f3b7474416c43
-
SHA1
dc5b6d6810fcd5139a383c8f9d84c81238eaa2ad
-
SHA256
574fffd479b4c36584008a4baa7216d3472cfcc6be36342708898efc3d73a656
-
SHA512
bdc869c1349d45dfaa1a59d2d95f7a75102a8b0053646757c7cd4ec347f15f1fced8df1964c33c0c570deda4415035798921ae98bb034437bb0b80bd3a94ede0
-
SSDEEP
1536:U20UGCrqTwaNzyMnA78OvLUUiAAd7i5tR9uO4zAOeGTvEE6TlkzmCW:d0WOzTnWrzZ0O40OyE6NCW
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-