Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118

  • Size

    58KB

  • Sample

    241016-be9rdavcng

  • MD5

    4ac1d5cd93c0ff815c3839f7fcc21ccc

  • SHA1

    5893a5f1cab81d264ae8ff9f87d827709f575885

  • SHA256

    cf5c0089ab31914db49b9344234f622235b5f48adbfa8873747c444e9a84ceda

  • SHA512

    a6d4aeccecfea85d1cc1e120bc744e5265fe7e9122c58062c1a8ad3380e980391790f5c242e1fc6a5ee1797f50536a4fbe9b0586fd35bdea2e29c2efa5482207

  • SSDEEP

    1536:OSb2aQS0/TPaHXZsiz+OBR3uNnHFNL35t:OS87C6izFoNnHXH

Malware Config

Targets

    • Target

      4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118

    • Size

      58KB

    • MD5

      4ac1d5cd93c0ff815c3839f7fcc21ccc

    • SHA1

      5893a5f1cab81d264ae8ff9f87d827709f575885

    • SHA256

      cf5c0089ab31914db49b9344234f622235b5f48adbfa8873747c444e9a84ceda

    • SHA512

      a6d4aeccecfea85d1cc1e120bc744e5265fe7e9122c58062c1a8ad3380e980391790f5c242e1fc6a5ee1797f50536a4fbe9b0586fd35bdea2e29c2efa5482207

    • SSDEEP

      1536:OSb2aQS0/TPaHXZsiz+OBR3uNnHFNL35t:OS87C6izFoNnHXH

    • Renames multiple (2200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks