Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

5205816a75...18.exe

windows7-x64

7

5205816a75...18.exe

windows10-2004-x64

7

$PLUGINSDI...am.dll

windows7-x64

3

$PLUGINSDI...am.dll

windows10-2004-x64

3

$PLUGINSDI...eb.dll

windows7-x64

3

$PLUGINSDI...eb.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...K2.dll

windows7-x64

3

$PLUGINSDI...K2.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

3

$PLUGINSDI...te.dll

windows10-2004-x64

3

$PLUGINSDI...nd.dll

windows7-x64

3

$PLUGINSDI...nd.dll

windows10-2004-x64

3

winever_ev700.exe

windows7-x64

7

winever_ev700.exe

windows10-2004-x64

7

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows7-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/WinOS.dll

windows7-x64

3

$PLUGINSDIR/WinOS.dll

windows10-2004-x64

3

winext.exe

windows7-x64

1

winext.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5205816a750cb86b88614ea22faa75b3_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241017-pfdbfszgrr

  • MD5

    5205816a750cb86b88614ea22faa75b3

  • SHA1

    3baadad2368136bcff6fcb8af87b6cc00aa9b6cb

  • SHA256

    a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099

  • SHA512

    1d499bbb3b1eba26953f046e46ef23f6d407f958f0add500efb5d934e264042328434731a61d9f8cd00e33b5551f1190c02c52278af3d6e03a0a491c9fbd3ec4

  • SSDEEP

    49152:+JoY1Zt0lF/80bvurP1mDufYZ0MynTW3B:artkW0bv+9fGynQ

Score
7/10
discovery

Malware Config

Targets

    • Target

      5205816a750cb86b88614ea22faa75b3_JaffaCakes118

    • Size

      1.8MB

    • MD5

      5205816a750cb86b88614ea22faa75b3

    • SHA1

      3baadad2368136bcff6fcb8af87b6cc00aa9b6cb

    • SHA256

      a30c050d5c41a945070a45ed9b547fe0d9def41a86a09cb6ca600382faf64099

    • SHA512

      1d499bbb3b1eba26953f046e46ef23f6d407f958f0add500efb5d934e264042328434731a61d9f8cd00e33b5551f1190c02c52278af3d6e03a0a491c9fbd3ec4

    • SSDEEP

      49152:+JoY1Zt0lF/80bvurP1mDufYZ0MynTW3B:artkW0bv+9fGynQ

    Score
    7/10
    discovery

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/DLLWaitForKillProgram.dll

    • Size

      28KB

    • MD5

      9c4b8ec42d89f7557bfd90798ce52787

    • SHA1

      2376dde426ea65aa27c30e304086310605382475

    • SHA256

      ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

    • SHA512

      17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

    • SSDEEP

      96:EP5ZuFye0MyQW4uPwhs+R/+gFrE1m/U/uG98bp2y+HS21kEZ1b+4Tu9C1uGg8wBu:akFyFRQ5wIzlH/UGq36EZY4T+Gul8U

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/DLLWeb.dll

    • Size

      28KB

    • MD5

      b382d6c8d5c6a437b2064d79b5dee47b

    • SHA1

      f8f4eae50d59b3b94762b10984c1fdcf4c08ff47

    • SHA256

      bdb051e1d7fd7b062341b8cb2efce180f2fbb83739fd2143262034be0f2396f3

    • SHA512

      e6d604d18b28beb30c09d987472540306abd925048f58a3c99a4013d44b9f29112419ca15c1bb7ee1560300bf179f9e98dd7e6db75e5aeb0e44fba47ac2dcc99

    • SSDEEP

      96:rP3KIyqFIAedN/0AatJ/l7R6TxNFOUodK8X9/r+uFBudGaxfP0:rP3K79N/HatJ/36T15jcAyYdbx3

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/IEFunctions.dll

    • Size

      3KB

    • MD5

      9701818d39318145dd164794ef3a3846

    • SHA1

      7db701f8dc19163d46ba88e8b68d8dbf428a8152

    • SHA256

      3122b0413f74e88518cfd1b9c6e18435dd326ca177a2374b6405df78f43e776a

    • SHA512

      d92786630250e9eb6c47537b09684fa107f959b50d255c7f3952741eb438c3be47e171827d3a4407b049c33c12dad73f8ec381a7265b28a6d8ca101ff702e8a4

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/ISCHECK2.dll

    • Size

      92KB

    • MD5

      9b758e25eeb7298a61776391310a11f7

    • SHA1

      5f05ac39f0027197e391e0ef43a3ef9ec160426a

    • SHA256

      7e58ea6ce4c690eb69b16cb1260a9d7127fcb6cdd43cfa1f360571607d9b9a9e

    • SHA512

      23f1236a0181b3735e4f311781c236b78883f8f76ee3b3ba0cd2ab6836a7977d8ea4ff16546d00d5419ed4190e584d4ceeba2389ed9c4325a84d468ee883895c

    • SSDEEP

      1536:AoTXP/uITCTzMjyAnn1G3ppft2P58oqaZGPsVkw6:DfazMOAIjt2PSoqaZ7mw6

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      36KB

    • MD5

      6958016193a066833556992077bad4fe

    • SHA1

      5f564945936f99381d7e2408f034f97d069005a4

    • SHA256

      f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

    • SHA512

      fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

    • SSDEEP

      384:IL6T2Izs/XGCanZSwEfj5lwTSYlml89oayKA15JiQNRw/9uosAUdJofiiqd:88Y9gZSwq1lwTS2XA15DRm9cddJo6l

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/SelfDelete.dll

    • Size

      24KB

    • MD5

      7bf1bd7661385621c7908e36958f582e

    • SHA1

      43242d7731c097e95fb96753c8262609ff929410

    • SHA256

      c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

    • SHA512

      8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

    • SSDEEP

      96:1dIrJYYrzPpqAAZ9sNIaI2y9WulXEGNRrG:nuYATpq/viyYuEYRr

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/processes_second.dll

    • Size

      140KB

    • MD5

      f0a1eae66dd2f54fbe26c26db5493a6f

    • SHA1

      46d56b4c6694da1ec4d88b0a5b153dad02b5dca7

    • SHA256

      8fe4dad8f894bcdb9a83a9d302907de404695be4b50e619afd88f09d72583e69

    • SHA512

      e1b3c946e90fc30b6cdf953c8c7e96121b462bf8529099e0587f7f243b9d73eeba52b510dd2598937f188f7a35bc1e3785b7589ec6c249996a5795c10dafd1e7

    • SSDEEP

      3072:F+WSoWifAbFBgChOQcNg3kirQDNgv3gp9Ibzls8:iAAbFBgChOzNgUrDNgvgp

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      winever_ev700.exe

    • Size

      1.6MB

    • MD5

      dce481dc793735312c681fffc636bfde

    • SHA1

      e4d5d2f32b01ceaea685b7b286e27c75baeafaf9

    • SHA256

      2a37a0585e7f61c3e3a6f49b0db10b6b23bc6fbf7d41b814f292200e6be33019

    • SHA512

      2fd8fbb95b63903ec64bcfc9576e6f9b93b475983985aad8f523ae37355d3156f362c16817231ddc70aefa70fa2adeecd8d55eb1c7619d1547ccc4b7cb92f262

    • SSDEEP

      24576:r+PSzUFt8Vzw8y9/gRxxCuAmI+EQrmVln5sgxUd52WujzNYttloMZiZMfg8+QS3L:qyitJ8LT8QEQrmpGDVujxuEMZiFznL

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/Processes.dll

    • Size

      140KB

    • MD5

      3c3cda1dabf094f7be067e1d69342d57

    • SHA1

      95bc35eaefd13a3f19783df87111a545395c3e27

    • SHA256

      bb65cb9dba34680beaacf9c644cd3eff3ea79b674d00ed215835d4c3e0ae621c

    • SHA512

      b35b8be0a190f88193818e16ea1354ec792047d38d93d16753d639353e3cb2edecacb41eb10418e55c26479f9a6e2145ed9055429ebccaf43e91e3f9f85bb82f

    • SSDEEP

      3072:LOGyjPivQLVBgCh+ApMmnkigDewVQM3oHzlD8:QwQLVBgCh+qMmk7DewVQM

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $PLUGINSDIR/SimpleSC.dll

    • Size

      61KB

    • MD5

      859a019ff8cd23433bb0f6147773680c

    • SHA1

      81cf2c41259ff5abc898ee31c3d67d6c0d26d506

    • SHA256

      eab581d0ba757ff654dacd3349593ebd5aab632f46167ede10111c4ad50156e8

    • SHA512

      50aa51d6f9827575cfd004e33ba4f4d17f2b24956bbdb861948419e80be4db20cda6beb6f43d3921cf9e512a61662290e037ebcdc275da7319fbc53907007ff1

    • SSDEEP

      1536:E/qXv1si+Xsp9MNfPTM+hcQOz18rW5R8c4fx+tnA:rv1EXZBP7T3rW5R87x+tn

    Score
    3/10
    discovery
    behavioral23behavioral24

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral25behavioral26

    • Target

      $PLUGINSDIR/WinOS.dll

    • Size

      44KB

    • MD5

      d1590cb1b028642d102e1d83a2416c6d

    • SHA1

      1019074325a97d3e441b42c88cbfbff117c91b07

    • SHA256

      6f172dcd874d8aacad8d111d6b5296273fe9b568df472f429c046148303b164d

    • SHA512

      1280e38d48132cae8614e1327ae285b40dd4bbc37c0c5bb4425af1794fbc3f690b8dd09221e16729795fa39b6d4e7f199a15b63a068e600ebbb0ec7952db9aea

    • SSDEEP

      384:e21xs/yT57PzAVthrKLHRSe/o37askMHJ3PyOfBJIVpYUu4st5USkavlPx7cRz03:K6ThPzebiRS33ftPZ5JIVuUQNTvlPIz

    Score
    3/10
    discovery
    behavioral27behavioral28

    • Target

      winext.exe

    • Size

      1.4MB

    • MD5

      8b3e99a0c6b84dd104eb673923a1d542

    • SHA1

      a5b095c0b87bfcc7cbc1e72c43b2b7682f885aaf

    • SHA256

      b7870b98eb389e00f7926b2651415bc03d475526a05f117648ec54846b26ebac

    • SHA512

      dc44f86844627d993dcf2530294062d50da016fe3e8623b20074d1910acd14a77f2d07cc03b85fc7e46a690583937df1f51d2c0130a395e3d6b4a8d3a56940e7

    • SSDEEP

      24576:q8izdkyI/9R0xnuxmP+PQzmela9rZzSd5TMu0sNYc8R0MZGv:qbk1mRWPQzmL4Dgu0IrXMZGv

    Score
    3/10
    discovery
    behavioral29behavioral30

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
7/10

behavioral20

discovery
Score
7/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

Score
1/10

behavioral30

discovery
Score
3/10