Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4114fb6bc2ba49dd5af753063e888f35_JaffaCakes118

  • Size

    191KB

  • Sample

    241013-vqym2axgpb

  • MD5

    4114fb6bc2ba49dd5af753063e888f35

  • SHA1

    884fccf4f3c9e0fb966619ed2b2da5a463fb9284

  • SHA256

    739e8e424e8a3bf082fdca40207caaf67cc3b1d76b41744902b8142497a3c56b

  • SHA512

    9e04e9d579624181eda5c055f448ec68286bc22ef8ffcc715b1f3f9a3622b83adee6da478a924723f5c5fa8aafc89b55eba3de6f4e634f2761cbcb81c9040622

  • SSDEEP

    3072:22j0wLl/EC8sW89i+6X367jtTgFhN7IrwsBcxeXBYcxfW9ask+hfebTtqEos8U4j:22j0cl8C8sWj+6X36vtTEN7QL51GasVj

Malware Config

Targets

    • Target

      4114fb6bc2ba49dd5af753063e888f35_JaffaCakes118

    • Size

      191KB

    • MD5

      4114fb6bc2ba49dd5af753063e888f35

    • SHA1

      884fccf4f3c9e0fb966619ed2b2da5a463fb9284

    • SHA256

      739e8e424e8a3bf082fdca40207caaf67cc3b1d76b41744902b8142497a3c56b

    • SHA512

      9e04e9d579624181eda5c055f448ec68286bc22ef8ffcc715b1f3f9a3622b83adee6da478a924723f5c5fa8aafc89b55eba3de6f4e634f2761cbcb81c9040622

    • SSDEEP

      3072:22j0wLl/EC8sW89i+6X367jtTgFhN7IrwsBcxeXBYcxfW9ask+hfebTtqEos8U4j:22j0cl8C8sWj+6X36vtTEN7QL51GasVj

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks