Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    540583f96e62385fd02eb7300062d7be_JaffaCakes118

  • Size

    128KB

  • Sample

    241017-2agsxazerc

  • MD5

    540583f96e62385fd02eb7300062d7be

  • SHA1

    48e628b085d6c22ac4caceeac3e0a2c97d9431c1

  • SHA256

    777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec

  • SHA512

    ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922

  • SSDEEP

    1536:/514vVST27uuynw8P9xpdRGf4kVMjE1woL97tmfCk2urv5:h2vVSTayn/P9XupVio4fCklrv5

Malware Config

Targets

    • Target

      540583f96e62385fd02eb7300062d7be_JaffaCakes118

    • Size

      128KB

    • MD5

      540583f96e62385fd02eb7300062d7be

    • SHA1

      48e628b085d6c22ac4caceeac3e0a2c97d9431c1

    • SHA256

      777dfe8c30de4ea764095bba9ea1762d932457bd7564cdce0713ae8f58c5bdec

    • SHA512

      ee1da166c023b83891f5270e083822889713d45361f22da16948bd07add30c3bb04f08ce1e1078c9e287d4ef01d0d41ca609973912b30c0a3170728faed57922

    • SSDEEP

      1536:/514vVST27uuynw8P9xpdRGf4kVMjE1woL97tmfCk2urv5:h2vVSTayn/P9XupVio4fCklrv5

    • Modifies visiblity of hidden/system files in Explorer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks