Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118
-
Size
58KB
-
Sample
241016-be9rdavcng
-
MD5
4ac1d5cd93c0ff815c3839f7fcc21ccc
-
SHA1
5893a5f1cab81d264ae8ff9f87d827709f575885
-
SHA256
cf5c0089ab31914db49b9344234f622235b5f48adbfa8873747c444e9a84ceda
-
SHA512
a6d4aeccecfea85d1cc1e120bc744e5265fe7e9122c58062c1a8ad3380e980391790f5c242e1fc6a5ee1797f50536a4fbe9b0586fd35bdea2e29c2efa5482207
-
SSDEEP
1536:OSb2aQS0/TPaHXZsiz+OBR3uNnHFNL35t:OS87C6izFoNnHXH
Static task
static1
Behavioral task
behavioral1
Sample
4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
4ac1d5cd93c0ff815c3839f7fcc21ccc_JaffaCakes118
-
Size
58KB
-
MD5
4ac1d5cd93c0ff815c3839f7fcc21ccc
-
SHA1
5893a5f1cab81d264ae8ff9f87d827709f575885
-
SHA256
cf5c0089ab31914db49b9344234f622235b5f48adbfa8873747c444e9a84ceda
-
SHA512
a6d4aeccecfea85d1cc1e120bc744e5265fe7e9122c58062c1a8ad3380e980391790f5c242e1fc6a5ee1797f50536a4fbe9b0586fd35bdea2e29c2efa5482207
-
SSDEEP
1536:OSb2aQS0/TPaHXZsiz+OBR3uNnHFNL35t:OS87C6izFoNnHXH
Score9/10-
Renames multiple (2200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1