Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

08083bc8f4...18.exe

windows7-x64

7

08083bc8f4...18.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

ffRichMedi...ion.js

windows7-x64

3

ffRichMedi...ion.js

windows10-2004-x64

3

ff/chrome/...e12.js

windows7-x64

3

ff/chrome/...e12.js

windows10-2004-x64

3

ff/chrome/...ion.js

windows7-x64

3

ff/chrome/...ion.js

windows10-2004-x64

3

ie/RichMed...12.dll

windows7-x64

6

ie/RichMed...12.dll

windows10-2004-x64

6

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08083bc8f45ae64eac00537129f5bf8a_JaffaCakes118

  • Size

    657KB

  • Sample

    241002-am9kxa1gqe

  • MD5

    08083bc8f45ae64eac00537129f5bf8a

  • SHA1

    48e6f04b2dd238ef2a6a09b4c309a3c40153ae22

  • SHA256

    2911feecf3f18123b896d468abc66fe8de08549d1ae751f03bf18170225291aa

  • SHA512

    e6f1b8a3a2a0a56197f02864c254ef243e23a39d6e88cddb4e85fbbea41fc3ad33e5e4cfa2a1fafaf2ef985cf8458433cf9470098b8d8646cd51584e4032f4ad

  • SSDEEP

    12288:FDhIifeKOG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BDq4KarQTwJ8ePB/p5uO71U26et:FTgG4GQm4OaHYJ8eP4D5uOHBBW4KaSwl

Score
7/10
adwarediscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      08083bc8f45ae64eac00537129f5bf8a_JaffaCakes118

    • Size

      657KB

    • MD5

      08083bc8f45ae64eac00537129f5bf8a

    • SHA1

      48e6f04b2dd238ef2a6a09b4c309a3c40153ae22

    • SHA256

      2911feecf3f18123b896d468abc66fe8de08549d1ae751f03bf18170225291aa

    • SHA512

      e6f1b8a3a2a0a56197f02864c254ef243e23a39d6e88cddb4e85fbbea41fc3ad33e5e4cfa2a1fafaf2ef985cf8458433cf9470098b8d8646cd51584e4032f4ad

    • SSDEEP

      12288:FDhIifeKOG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BDq4KarQTwJ8ePB/p5uO71U26et:FTgG4GQm4OaHYJ8eP4D5uOHBBW4KaSwl

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      ffRichMediaViewV1release12chaction.js

    • Size

      854B

    • MD5

      70fcd925e9e4e43195f7f31f6f56af2b

    • SHA1

      385b317e6bc8ac059795c1094a0145f0f901851a

    • SHA256

      c8b2f49771bdf24b3b4f8d83edd95e5af578862ce7c2e072e017b1f140bb793e

    • SHA512

      4d541d5b6bcb7bee637428487bf30ce6fb478b92f146ac6737f6a056102ec771e69443e5f84fd9816859eb69eb1f553db07cd49cc249d592220ef836a86ca58b

    Score
    3/10
    execution
    behavioral5behavioral6

    • Target

      ff/chrome/content/ffRichMediaViewV1release12.js

    • Size

      759B

    • MD5

      56ddef76ddc59b1847645c3dfec87216

    • SHA1

      7158b459b2886574db06062b101b474d35f72643

    • SHA256

      97aa379048506d2f8ad42ec4dc7f809b7b4132ddb639558aabdf967bb67b0465

    • SHA512

      725404b94f47423dc5516fca508f1b08fce636825f1099452822b4f36632b74e9cea51a01f5941b728a4c8bddba5e31261feea752b405c39c448e2d0784d31e7

    Score
    3/10
    execution
    behavioral7behavioral8

    • Target

      ff/chrome/content/ffRichMediaViewV1release12ffaction.js

    • Size

      694B

    • MD5

      16e0931eb7060b57c52fbf9ebec25203

    • SHA1

      f8ecbce2a003c355064f7a80fa9ede4a6b6ddbf4

    • SHA256

      295adbf47e11bc1f0f25ae7b04a4ab6630a661131484ed04eb4c01c495ecbbe3

    • SHA512

      e7227f62015884de210cfe2475acc3942c851f8d0f92df53bba9953d612189bf2877fb2c60e3c908b48513034939dda174d886e74fa8b076001164ed44060d66

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      ie/RichMediaViewV1release12.dll

    • Size

      85KB

    • MD5

      591f4033ed21acd6bd22d77d682abe20

    • SHA1

      d042b2d3d3a0fd9538a4ad29c15ff838481554e6

    • SHA256

      d74fad44256edb495e4b605375fe6e08469a3484b3eeb74cf3fa5813914c2667

    • SHA512

      50f537af5f9cd396b3df38ca233066e5b2c2b57bf344e2c79370106f15d7f84d5148a12e4f926e8b839a46b3867b3eae6d8c69968dc00b9b3aa7c6783b9fc59d

    • SSDEEP

      1536:Yc/9Cs8ekkcEDtqJ6Zk8Dkb7xnLlQvpuEpY:D9eekkcEJqJ6ZG7xLavpuX

    Score
    6/10
    adwarediscoverystealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      uninstall.exe

    • Size

      289KB

    • MD5

      1b8f7dd0715a72537972a474ddec3acd

    • SHA1

      5f18ebef0c05b173830d3ac2a18f77e18ee588ef

    • SHA256

      94ad80767e91e46e1eb5c5bad9c3c60af4d7ce52ae24be3b75c0665343ccba43

    • SHA512

      5ac4acc1b3d3d3b9ee53d9090bb295aa3ec030b62270576077fdd8b0c7af299ff406d9f6496eb0deea8085a09af90ff43ebf1ca2ca6236bd784a83e04681a58d

    • SSDEEP

      6144:Ue34m+Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmG:n+q4OaQQTYJ8eP4/L5uO7D3f5Bb

    Score
    7/10
    discoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    discovery
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks