Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    108371ef36e513fe10d28555b11f25d5_JaffaCakes118

  • Size

    114KB

  • Sample

    241003-zzezhazfqg

  • MD5

    108371ef36e513fe10d28555b11f25d5

  • SHA1

    989275215b0497d1d5eb16d34548183bffb3f333

  • SHA256

    a810d7db2f261f9407731d7122361b3df0e83501a0a2fbd2c32aaac6c651a456

  • SHA512

    82385b6e26c9e650b5da73841927505b338d0312278ac438c084f0542afaac4fc9207cdb41f2b0dc1cc2fc896fe06385187d170554c0ebd142452d5987618538

  • SSDEEP

    3072:CuH2Pz4lYzvVbr7IPJCnWVxSBwGBOtAapckMIYp:Cu2Pz4e7dr7A5VxYJBLkMj

Malware Config

Targets

    • Target

      108371ef36e513fe10d28555b11f25d5_JaffaCakes118

    • Size

      114KB

    • MD5

      108371ef36e513fe10d28555b11f25d5

    • SHA1

      989275215b0497d1d5eb16d34548183bffb3f333

    • SHA256

      a810d7db2f261f9407731d7122361b3df0e83501a0a2fbd2c32aaac6c651a456

    • SHA512

      82385b6e26c9e650b5da73841927505b338d0312278ac438c084f0542afaac4fc9207cdb41f2b0dc1cc2fc896fe06385187d170554c0ebd142452d5987618538

    • SSDEEP

      3072:CuH2Pz4lYzvVbr7IPJCnWVxSBwGBOtAapckMIYp:Cu2Pz4e7dr7A5VxYJBLkMj

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • UAC bypass

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.