Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    02a865b167b5088f909441f34eb46dd8_JaffaCakes118

  • Size

    470KB

  • Sample

    240930-wvxrzasgjb

  • MD5

    02a865b167b5088f909441f34eb46dd8

  • SHA1

    ad00d83f7dee2404846a0ec338b7cbc3c70961ce

  • SHA256

    aea492182ac46cb4b0a4eb5b309257aa71fa63d7eaad740b9085eb2837a6e50f

  • SHA512

    b223850833ed96816f0b494bfa3264a8ba92bb820ff5078f1b31179acda691a6ed72f80618bdce0ce916fa248e0be4de88f0cfc81bcfb853e89a1c46922a7963

  • SSDEEP

    12288:5F5uZ3eVh7Gxk7Mef6chlgO3vw/4La/SXgHzMDVlt:5qeVh7u+7fPgO3Y0QzM5

Malware Config

Targets

    • Target

      02a865b167b5088f909441f34eb46dd8_JaffaCakes118

    • Size

      470KB

    • MD5

      02a865b167b5088f909441f34eb46dd8

    • SHA1

      ad00d83f7dee2404846a0ec338b7cbc3c70961ce

    • SHA256

      aea492182ac46cb4b0a4eb5b309257aa71fa63d7eaad740b9085eb2837a6e50f

    • SHA512

      b223850833ed96816f0b494bfa3264a8ba92bb820ff5078f1b31179acda691a6ed72f80618bdce0ce916fa248e0be4de88f0cfc81bcfb853e89a1c46922a7963

    • SSDEEP

      12288:5F5uZ3eVh7Gxk7Mef6chlgO3vw/4La/SXgHzMDVlt:5qeVh7u+7fPgO3Y0QzM5

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks