Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    429727607f19019d28c55c673bc3f0ab_JaffaCakes118

  • Size

    250KB

  • Sample

    241014-qzn3qsxhqb

  • MD5

    429727607f19019d28c55c673bc3f0ab

  • SHA1

    fabf52a135c4ae4a6376190da7b7ed0b9243798f

  • SHA256

    628584470054ce6376e9dbaac5ebb1b5477beb1d60a2faab6a20704fb96a18d6

  • SHA512

    ef594f1f57dea45437f39d3f2af414d4f4895c29eba227146a0067a61e6e1103a136f382ce9e2972165a3281b61a0f52a790592112f714f05519a525bea6b5b7

  • SSDEEP

    6144:ihieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:feKrJJuf86AYcwoaoSbr

Malware Config

Targets

    • Target

      429727607f19019d28c55c673bc3f0ab_JaffaCakes118

    • Size

      250KB

    • MD5

      429727607f19019d28c55c673bc3f0ab

    • SHA1

      fabf52a135c4ae4a6376190da7b7ed0b9243798f

    • SHA256

      628584470054ce6376e9dbaac5ebb1b5477beb1d60a2faab6a20704fb96a18d6

    • SHA512

      ef594f1f57dea45437f39d3f2af414d4f4895c29eba227146a0067a61e6e1103a136f382ce9e2972165a3281b61a0f52a790592112f714f05519a525bea6b5b7

    • SSDEEP

      6144:ihieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:feKrJJuf86AYcwoaoSbr

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks