Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0c2b1dd5b9...18.exe

windows7-x64

7

0c2b1dd5b9...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c2b1dd5b9eb64ad6130c61826cf2864_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241002-x7r8pawfqg

  • MD5

    0c2b1dd5b9eb64ad6130c61826cf2864

  • SHA1

    ac1c145695ee0aece971260fb1af2115de58c0fa

  • SHA256

    e849b0de5209dbb7a6e96f840ff17121fb2d147d231386d52a261f1f92945e38

  • SHA512

    734d12cc8c5ed780f6e254b08c9475ea17c26383f789caa8a4502b2f422e4d2505b2addfee15fa7dd3618f1cd7ae8118c3d22e3bcfe0ff08f41b3e65cef3c530

  • SSDEEP

    24576:+JGrlbe0tPFPiB3Qz+9G/o1CWEzdFtVzGKm/0PbV4R:+JGrlbe0tPFaBAza0otEzdDVvm8zV4

Score
7/10
discoverypersistence

Malware Config

Targets

    • Target

      0c2b1dd5b9eb64ad6130c61826cf2864_JaffaCakes118

    • Size

      1.1MB

    • MD5

      0c2b1dd5b9eb64ad6130c61826cf2864

    • SHA1

      ac1c145695ee0aece971260fb1af2115de58c0fa

    • SHA256

      e849b0de5209dbb7a6e96f840ff17121fb2d147d231386d52a261f1f92945e38

    • SHA512

      734d12cc8c5ed780f6e254b08c9475ea17c26383f789caa8a4502b2f422e4d2505b2addfee15fa7dd3618f1cd7ae8118c3d22e3bcfe0ff08f41b3e65cef3c530

    • SSDEEP

      24576:+JGrlbe0tPFPiB3Qz+9G/o1CWEzdFtVzGKm/0PbV4R:+JGrlbe0tPFaBAza0otEzdDVvm8zV4

    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks