Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    417fb9703853850b3d4b979b597b01e3_JaffaCakes118

  • Size

    318KB

  • Sample

    241013-xhbveawhpl

  • MD5

    417fb9703853850b3d4b979b597b01e3

  • SHA1

    962ad7d72d492a30fb89b9c70820abc684a523b7

  • SHA256

    e3ae00173a66ba93a6e9afbaf7395116d55fe3d68a8cf2141a03f70acbc38a27

  • SHA512

    fb8f3fec41e311a392db7ae9e69c4aff6259c0422422eb69a07d18f9a481444173ff118729b843258962e807e0572fafe8c2c77e0f9c70527f4875b5864d0093

  • SSDEEP

    6144:V7aHPl2nXPnnPpvRtt+nDf9eCTPONc80gYk+rB9xoaAo/0Cd/yLQ:V7ql2/xZADfPTPONDrYkEPtAIdaE

Malware Config

Targets

    • Target

      417fb9703853850b3d4b979b597b01e3_JaffaCakes118

    • Size

      318KB

    • MD5

      417fb9703853850b3d4b979b597b01e3

    • SHA1

      962ad7d72d492a30fb89b9c70820abc684a523b7

    • SHA256

      e3ae00173a66ba93a6e9afbaf7395116d55fe3d68a8cf2141a03f70acbc38a27

    • SHA512

      fb8f3fec41e311a392db7ae9e69c4aff6259c0422422eb69a07d18f9a481444173ff118729b843258962e807e0572fafe8c2c77e0f9c70527f4875b5864d0093

    • SSDEEP

      6144:V7aHPl2nXPnnPpvRtt+nDf9eCTPONc80gYk+rB9xoaAo/0Cd/yLQ:V7ql2/xZADfPTPONDrYkEPtAIdaE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks