Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

431d52eecf...18.exe

windows7-x64

8

431d52eecf...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    431d52eecffee9238010f5479a45da01_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241014-t1msvaydkp

  • MD5

    431d52eecffee9238010f5479a45da01

  • SHA1

    5fd9ed8d94df62381dd76077fade0f201490387b

  • SHA256

    dd7cbd59edd300dae05075e96dadc574728ce900bda00ce0131ab7bff4117a38

  • SHA512

    09a9d4a8886d135a320132d090115e48f5060bac53210e4f327102ba6564c45e92f5aacb976fc685b67e2c76249b639f5dece3076d9e8d58de5e1264a5eecda3

  • SSDEEP

    49152:/I0Dszc4WyPoBJFEswLXDnZh/klmMoXLuejK:/hszGJF76T//klA79jK

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      431d52eecffee9238010f5479a45da01_JaffaCakes118

    • Size

      1.7MB

    • MD5

      431d52eecffee9238010f5479a45da01

    • SHA1

      5fd9ed8d94df62381dd76077fade0f201490387b

    • SHA256

      dd7cbd59edd300dae05075e96dadc574728ce900bda00ce0131ab7bff4117a38

    • SHA512

      09a9d4a8886d135a320132d090115e48f5060bac53210e4f327102ba6564c45e92f5aacb976fc685b67e2c76249b639f5dece3076d9e8d58de5e1264a5eecda3

    • SSDEEP

      49152:/I0Dszc4WyPoBJFEswLXDnZh/klmMoXLuejK:/hszGJF76T//klA79jK

    Score
    8/10
    bootkitdiscoverypersistence

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks