Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0c7606e3f2f8ae8b8b04b27392fc2be0_JaffaCakes118
-
Size
95KB
-
Sample
241002-zy3deazglh
-
MD5
0c7606e3f2f8ae8b8b04b27392fc2be0
-
SHA1
041e42a273c91aada00fa17ff08ca62a755fbd6b
-
SHA256
66473b4875a5acb6c72d45321335065839c7607678e0dd9bf028508895d96f9b
-
SHA512
6971700773c07bdd25c171daadab7efb8405b6b975b6bd9e71aa028429c7cae00506dbf23060418e6e2d37c3657a8af3b54ae79c3f4e9b99ecc8397aa3f426e1
-
SSDEEP
1536:cNEtQrCwzs6yO+s8iiUExoM/ygXNRxkusQRDV0sK1MbFUJno:cNPCwzDyFs8iyoM6gX5YQRB0sjad
Static task
static1
Behavioral task
behavioral1
Sample
0c7606e3f2f8ae8b8b04b27392fc2be0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0c7606e3f2f8ae8b8b04b27392fc2be0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://mtfksui.pw:4915/way/like.php
http://ghkeoud.pw:4915/way/like.php
Targets
-
-
Target
0c7606e3f2f8ae8b8b04b27392fc2be0_JaffaCakes118
-
Size
95KB
-
MD5
0c7606e3f2f8ae8b8b04b27392fc2be0
-
SHA1
041e42a273c91aada00fa17ff08ca62a755fbd6b
-
SHA256
66473b4875a5acb6c72d45321335065839c7607678e0dd9bf028508895d96f9b
-
SHA512
6971700773c07bdd25c171daadab7efb8405b6b975b6bd9e71aa028429c7cae00506dbf23060418e6e2d37c3657a8af3b54ae79c3f4e9b99ecc8397aa3f426e1
-
SSDEEP
1536:cNEtQrCwzs6yO+s8iiUExoM/ygXNRxkusQRDV0sK1MbFUJno:cNPCwzDyFs8iyoM6gX5YQRB0sjad
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Files and Directories
-