Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
10631710d7f2305658a818d29e3f8eb1_JaffaCakes118
-
Size
563KB
-
Sample
241003-y5cwnaybqb
-
MD5
10631710d7f2305658a818d29e3f8eb1
-
SHA1
91c0e4a026083aa990bda896458b015711c453ec
-
SHA256
aaf9951bd01533db7c371bf4f5062308ee14cbd64032569970063774d2e3fd1a
-
SHA512
279707a4b83dabc75512b21a2a368616cba6490de1c738fbc7fd4d4b22bfc31147a5d4feb5a06b0815e3ff2575b6d6b0635d940d1674a95e51925300595440cd
-
SSDEEP
12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWyM:ENZunQU1aVNe3U24QLWyM
Static task
static1
Behavioral task
behavioral1
Sample
10631710d7f2305658a818d29e3f8eb1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
10631710d7f2305658a818d29e3f8eb1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
willies59740
Targets
-
-
Target
10631710d7f2305658a818d29e3f8eb1_JaffaCakes118
-
Size
563KB
-
MD5
10631710d7f2305658a818d29e3f8eb1
-
SHA1
91c0e4a026083aa990bda896458b015711c453ec
-
SHA256
aaf9951bd01533db7c371bf4f5062308ee14cbd64032569970063774d2e3fd1a
-
SHA512
279707a4b83dabc75512b21a2a368616cba6490de1c738fbc7fd4d4b22bfc31147a5d4feb5a06b0815e3ff2575b6d6b0635d940d1674a95e51925300595440cd
-
SSDEEP
12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWyM:ENZunQU1aVNe3U24QLWyM
Score10/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Executes dropped EXE
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1