Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    10b5cf240e810d8d8da710d54ded117c_JaffaCakes118

  • Size

    255KB

  • Sample

    241003-16v5qstamd

  • MD5

    10b5cf240e810d8d8da710d54ded117c

  • SHA1

    b28ec0c418d5545ec8101b269062761e6c03c18d

  • SHA256

    765f0480491caaf403a19e2bf71c35f686b5bcbe3897bad0770bf795eb70e517

  • SHA512

    5b09a241e5b132b2911c012c3d9709d7d018be76909d705719db642d7c7f9f44267ec732098cfa6cefdc747d76e759aa7b5c6b5e458bd16aab29aee442086bed

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s56O+GCTYX+S9j47IHt+:h1OgLdaOVhX+SKkN+

Malware Config

Targets

    • Target

      10b5cf240e810d8d8da710d54ded117c_JaffaCakes118

    • Size

      255KB

    • MD5

      10b5cf240e810d8d8da710d54ded117c

    • SHA1

      b28ec0c418d5545ec8101b269062761e6c03c18d

    • SHA256

      765f0480491caaf403a19e2bf71c35f686b5bcbe3897bad0770bf795eb70e517

    • SHA512

      5b09a241e5b132b2911c012c3d9709d7d018be76909d705719db642d7c7f9f44267ec732098cfa6cefdc747d76e759aa7b5c6b5e458bd16aab29aee442086bed

    • SSDEEP

      6144:h1OgDPdkBAFZWjadD4s56O+GCTYX+S9j47IHt+:h1OgLdaOVhX+SKkN+

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks