Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
02a865b167b5088f909441f34eb46dd8_JaffaCakes118
-
Size
470KB
-
Sample
240930-wvxrzasgjb
-
MD5
02a865b167b5088f909441f34eb46dd8
-
SHA1
ad00d83f7dee2404846a0ec338b7cbc3c70961ce
-
SHA256
aea492182ac46cb4b0a4eb5b309257aa71fa63d7eaad740b9085eb2837a6e50f
-
SHA512
b223850833ed96816f0b494bfa3264a8ba92bb820ff5078f1b31179acda691a6ed72f80618bdce0ce916fa248e0be4de88f0cfc81bcfb853e89a1c46922a7963
-
SSDEEP
12288:5F5uZ3eVh7Gxk7Mef6chlgO3vw/4La/SXgHzMDVlt:5qeVh7u+7fPgO3Y0QzM5
Static task
static1
Behavioral task
behavioral1
Sample
02a865b167b5088f909441f34eb46dd8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02a865b167b5088f909441f34eb46dd8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
02a865b167b5088f909441f34eb46dd8_JaffaCakes118
-
Size
470KB
-
MD5
02a865b167b5088f909441f34eb46dd8
-
SHA1
ad00d83f7dee2404846a0ec338b7cbc3c70961ce
-
SHA256
aea492182ac46cb4b0a4eb5b309257aa71fa63d7eaad740b9085eb2837a6e50f
-
SHA512
b223850833ed96816f0b494bfa3264a8ba92bb820ff5078f1b31179acda691a6ed72f80618bdce0ce916fa248e0be4de88f0cfc81bcfb853e89a1c46922a7963
-
SSDEEP
12288:5F5uZ3eVh7Gxk7Mef6chlgO3vw/4La/SXgHzMDVlt:5qeVh7u+7fPgO3Y0QzM5
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Drops file in System32 directory
-