Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0084a9756b...18.exe

windows7-x64

7

0084a9756b...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0084a9756b9a421ab2eda5dad31c8f87_JaffaCakes118

  • Size

    182KB

  • Sample

    240930-k3ncqawhql

  • MD5

    0084a9756b9a421ab2eda5dad31c8f87

  • SHA1

    ec6e5e17a4d567a78e5c50265dcb9b30d8c0f1cd

  • SHA256

    90e870524183aae7e86bc56c6d090700f861fd299fb8637e47812d55f0d568a3

  • SHA512

    0176f2228f2d0e601d073197b068a636135ec1c784b4f366db897cd3a7ff56506f765721c800e46127120b50a7f824ff54adf0118683e7f1f6aecbae85102d6e

  • SSDEEP

    3072:MffcX5/qoRiHRUPdqFjCTvySC6AAVhiItFkslmMYfqXdAFBFevcfOLG9DHknnipE:ucQoQKk6AA2SksM9fecF0L8DH4

Score
7/10
discoverypersistencespywarestealer

Malware Config

Targets

    • Target

      0084a9756b9a421ab2eda5dad31c8f87_JaffaCakes118

    • Size

      182KB

    • MD5

      0084a9756b9a421ab2eda5dad31c8f87

    • SHA1

      ec6e5e17a4d567a78e5c50265dcb9b30d8c0f1cd

    • SHA256

      90e870524183aae7e86bc56c6d090700f861fd299fb8637e47812d55f0d568a3

    • SHA512

      0176f2228f2d0e601d073197b068a636135ec1c784b4f366db897cd3a7ff56506f765721c800e46127120b50a7f824ff54adf0118683e7f1f6aecbae85102d6e

    • SSDEEP

      3072:MffcX5/qoRiHRUPdqFjCTvySC6AAVhiItFkslmMYfqXdAFBFevcfOLG9DHknnipE:ucQoQKk6AA2SksM9fecF0L8DH4

    Score
    7/10
    discoverypersistencespywarestealer

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks