Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    423aaa49a1c1e85de61ddbe5c8eb4732_JaffaCakes118

  • Size

    250KB

  • Sample

    241013-1kxrfavapk

  • MD5

    423aaa49a1c1e85de61ddbe5c8eb4732

  • SHA1

    b6f666d3965c784a923aac3e483d7bf31bc56a52

  • SHA256

    77bc3fe1a7c4288c677bdedaa109c49f2be19d729cbb2a0413b2e751323bd5b1

  • SHA512

    f1b4456c2eaa295cdae153a66f6b7096db551ae3359f7a92db9eeec31f1df00084b640e2349ed35f557de96997e7fa522c7c863e67630fee338017638ffd22ff

  • SSDEEP

    6144:khieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:leKrJJuf86AYcwoaoSbr

Malware Config

Targets

    • Target

      423aaa49a1c1e85de61ddbe5c8eb4732_JaffaCakes118

    • Size

      250KB

    • MD5

      423aaa49a1c1e85de61ddbe5c8eb4732

    • SHA1

      b6f666d3965c784a923aac3e483d7bf31bc56a52

    • SHA256

      77bc3fe1a7c4288c677bdedaa109c49f2be19d729cbb2a0413b2e751323bd5b1

    • SHA512

      f1b4456c2eaa295cdae153a66f6b7096db551ae3359f7a92db9eeec31f1df00084b640e2349ed35f557de96997e7fa522c7c863e67630fee338017638ffd22ff

    • SSDEEP

      6144:khieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:leKrJJuf86AYcwoaoSbr

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks