Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    64e777d2836dd154efb6d5cb8b769ba6_JaffaCakes118

  • Size

    185KB

  • Sample

    241021-a1cs4azbnb

  • MD5

    64e777d2836dd154efb6d5cb8b769ba6

  • SHA1

    3e141d8fc7986489dd7de370f732696cb802b80b

  • SHA256

    79717664a99d7a9bd277839768778badf14003c75952de01ca78ccf009ed693c

  • SHA512

    2e1c97f6a4a0dc9833c4c5abe839ec42d1f5f1a6b048c388def386ea6f66392a284a5be7d8f649415b31bdeadd511be1c9b42cb4a0255fa721b1bdd1bf6b07ee

  • SSDEEP

    3072:w04FXB0wS8dT8LAVAvI/CabDm/LUJhRWSTGKNwaoLIuVDz5ubfyMy:w0+RBdT8LOAvlqAqAz5QK

Malware Config

Targets

    • Target

      64e777d2836dd154efb6d5cb8b769ba6_JaffaCakes118

    • Size

      185KB

    • MD5

      64e777d2836dd154efb6d5cb8b769ba6

    • SHA1

      3e141d8fc7986489dd7de370f732696cb802b80b

    • SHA256

      79717664a99d7a9bd277839768778badf14003c75952de01ca78ccf009ed693c

    • SHA512

      2e1c97f6a4a0dc9833c4c5abe839ec42d1f5f1a6b048c388def386ea6f66392a284a5be7d8f649415b31bdeadd511be1c9b42cb4a0255fa721b1bdd1bf6b07ee

    • SSDEEP

      3072:w04FXB0wS8dT8LAVAvI/CabDm/LUJhRWSTGKNwaoLIuVDz5ubfyMy:w0+RBdT8LOAvlqAqAz5QK

    • Renames multiple (175) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks