Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
118bdc671926366c4354cdaf0db67483_JaffaCakes118
-
Size
64KB
-
Sample
241004-de6e3a1bjm
-
MD5
118bdc671926366c4354cdaf0db67483
-
SHA1
7fc6a61aeb1d9f0dfbf881718d0e724aaded535a
-
SHA256
dc2f5e9732dc23e151b243a9ea4108e103b73abb770ff4989f69ed3d18466f64
-
SHA512
191548e7233af041e0f13032e118798a0eef087c0f2734fb5be72142690145419f54249f143d7b4d013e8ec48d061d710045531947a88665fa01f77d91fdc975
-
SSDEEP
1536:B01zqIfhbp1pe7jmyQ5uFxm6W0h4HSZYgc/slo5b6eXXtpsjP5:DmyouaUhaBL/G5jh
Static task
static1
Behavioral task
behavioral1
Sample
118bdc671926366c4354cdaf0db67483_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
118bdc671926366c4354cdaf0db67483_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://pglipik.ru:2346/pony/mac.php
http://pfixsel.ru:2346/pony/mac.php
Targets
-
-
Target
118bdc671926366c4354cdaf0db67483_JaffaCakes118
-
Size
64KB
-
MD5
118bdc671926366c4354cdaf0db67483
-
SHA1
7fc6a61aeb1d9f0dfbf881718d0e724aaded535a
-
SHA256
dc2f5e9732dc23e151b243a9ea4108e103b73abb770ff4989f69ed3d18466f64
-
SHA512
191548e7233af041e0f13032e118798a0eef087c0f2734fb5be72142690145419f54249f143d7b4d013e8ec48d061d710045531947a88665fa01f77d91fdc975
-
SSDEEP
1536:B01zqIfhbp1pe7jmyQ5uFxm6W0h4HSZYgc/slo5b6eXXtpsjP5:DmyouaUhaBL/G5jh
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Files and Directories
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3