Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

576dde4a85...18.exe

windows7-x64

7

576dde4a85...18.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

ffRichMedi...ion.js

windows7-x64

3

ffRichMedi...ion.js

windows10-2004-x64

3

ff/chrome/...215.js

windows7-x64

3

ff/chrome/...215.js

windows10-2004-x64

3

ff/chrome/...ion.js

windows7-x64

3

ff/chrome/...ion.js

windows10-2004-x64

3

ie/RichMed...15.dll

windows7-x64

6

ie/RichMed...15.dll

windows10-2004-x64

6

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...is.dll

windows7-x64

3

$PLUGINSDI...is.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    576dde4a8590b02882d5ab6b0e4f8e33_JaffaCakes118

  • Size

    657KB

  • Sample

    241018-pmykzawhjb

  • MD5

    576dde4a8590b02882d5ab6b0e4f8e33

  • SHA1

    9c98a377684919ce06cb716c84c5125006c5befb

  • SHA256

    bec0c91940afed9991f50da3f77b5ea77fd9f96a9b5ead592d7598257f40c823

  • SHA512

    fba4aad0f9e5afad377f8aec4e60896b15af192c11ebeec928d030998b9683c86d92a2050c449c7dbc24795d2cad1258fe803beb3854f46b08e8dcdbf38a160d

  • SSDEEP

    12288:mYhUq9EG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bnq4Wa/QTKJ8eP9/75uO7eU266Ba:mNQEG4GQm4OaHYJ8eP4D5uOHBBq4Waek

Score
7/10
adwarediscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      576dde4a8590b02882d5ab6b0e4f8e33_JaffaCakes118

    • Size

      657KB

    • MD5

      576dde4a8590b02882d5ab6b0e4f8e33

    • SHA1

      9c98a377684919ce06cb716c84c5125006c5befb

    • SHA256

      bec0c91940afed9991f50da3f77b5ea77fd9f96a9b5ead592d7598257f40c823

    • SHA512

      fba4aad0f9e5afad377f8aec4e60896b15af192c11ebeec928d030998b9683c86d92a2050c449c7dbc24795d2cad1258fe803beb3854f46b08e8dcdbf38a160d

    • SSDEEP

      12288:mYhUq9EG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bnq4Wa/QTKJ8eP9/75uO7eU266Ba:mNQEG4GQm4OaHYJ8eP4D5uOHBBq4Waek

    Score
    7/10
    adwarediscoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      ffRichMediaViewV1release6215chaction.js

    • Size

      864B

    • MD5

      f7521e88bce7aae4868d1cc6f32999f0

    • SHA1

      94a6bdf61c09a99869658747d6829578d2df4470

    • SHA256

      36b69879ac2c96e4e4ef51c25b41d3806aabecf470b92326a3bbb19fa34eb636

    • SHA512

      dcb4d0ea4a339ca04208557ba6ac958fda3f9a6a651743baf4037a8481305d48b299059e5c189e18d385e6637358946beed359cb1e8cf9733d0bcadaf3ff5ae0

    Score
    3/10
    execution
    behavioral5behavioral6

    • Target

      ff/chrome/content/ffRichMediaViewV1release6215.js

    • Size

      765B

    • MD5

      e25580eb8b2eff6984e7e1f6165d91a1

    • SHA1

      3cb42d38644deab934052e471a4717f6bbd2ad01

    • SHA256

      36ac868993a3a213bd7807574520fba18931cdc5dd48985ea83b745579489e80

    • SHA512

      4dc808699581f9e0fa9946883d4bc57de544b3ab19075485ab783d180f8383261274d85c074386a20048897f951f4a84a2692aab009ba2baf910d5854d1e820b

    Score
    3/10
    execution
    behavioral7behavioral8

    • Target

      ff/chrome/content/ffRichMediaViewV1release6215ffaction.js

    • Size

      702B

    • MD5

      6a62f136cadc1cc8a53dd1ffab5c6e9e

    • SHA1

      b612a691e4ca0a9f6a345c8c4452b0c0ca807f34

    • SHA256

      26fa9c3aacb825be4d9a16b17b1f764e3ae54a4490eb198a32a6ac0d2aa99769

    • SHA512

      2ff80b0577070c948afebb8ab670994ebc943ca1497f94747a2eae6546166a16616001ed07c4f931d2a18e6b8f3c5149f8460ed768baadcbc851a334a2f8772c

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      ie/RichMediaViewV1release6215.dll

    • Size

      85KB

    • MD5

      a8dba3d5e0bd9338706b7026a5f4b558

    • SHA1

      45a152b4ee2b609940558f983f17d71f0aa720bd

    • SHA256

      77b21edf0f6037b7c8d9af93e5cce4f6a8de7c8354d7fa4ef573f9ae79690ca6

    • SHA512

      dba1d60a4a52ffaf49f4ade1bdfdc821b2809cb783e6d9726b5016d53f07bca9fc77c0f707103d972d240f292c9745281173cd19b05ba37333b767872d448b24

    • SSDEEP

      1536:zRsmScYsswPlt6Ap1ZcTkLCy1CjfLlQ/OqX:6m6sswPX6Ap1h1wa/OqX

    Score
    6/10
    adwarediscoverystealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12

    • Target

      uninstall.exe

    • Size

      289KB

    • MD5

      3d26df34a1eb84fb5f7766f84e173f98

    • SHA1

      cf878305e78d1d64f8555af5a9d1d883bdced53e

    • SHA256

      cd2e1d96df23578de585ff965878f01889ba0d57bd5f8a926cd20f8c147465bb

    • SHA512

      2209eea4253a0d29975aab6a7ca98ab8031feb3d959831f4a9dcba8ec4b056bd85b212d8b32be5d33bcae80ea5af0585c10c493648ca05d74ebae075a4376d34

    • SSDEEP

      6144:Ue34F8Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bms:g8q4OaQQTYJ8eP4/L5uO7D3f5BJ

    Score
    7/10
    discoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/aminsis.dll

    • Size

      567KB

    • MD5

      450753ad96785a240a39deccab3af0d0

    • SHA1

      21c544064d2ffa6444508268ce258a330d459fc5

    • SHA256

      1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3

    • SHA512

      c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab

    • SSDEEP

      12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

    Score
    3/10
    discovery
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks