Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
5762c76c136...18.exe
windows7-x64
7762c76c136...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...pt.dll
windows7-x64
3$PLUGINSDI...pt.dll
windows10-2004-x64
3$TEMP/$_0_.exe
windows7-x64
7$TEMP/$_0_.exe
windows10-2004-x64
7General
-
Target
762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118
-
Size
1.8MB
-
Sample
241027-11ntga1ncw
-
MD5
762c76c136c918f6c647dcdc40f6b2f3
-
SHA1
c5d3cfdfedac8cb8c4947bf26a4e0a0bba87e87e
-
SHA256
8fd29d1d962db08395a002bb5aff7c87f63d90d9a9944787f0e1c09011749b8f
-
SHA512
3e0747790138c02572e53b811de9fc21eafef68acd03d1d124529ad1e4c99ca9a2bfd38de2c7c133405c4de1ffcf0562651eeaa3d401113c653af118186d3bdc
-
SSDEEP
49152:kcD54XQyecauzXbxNcCLN6hPnKzYdnDoM0hxd7u:kS5yjXBBohPnKwDa3dy
Behavioral task
behavioral1
Sample
762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/tkDecript.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/tkDecript.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$TEMP/$_0_.exe
Resource
win7-20241023-en
Malware Config
Targets
-
-
Target
762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118
-
Size
1.8MB
-
MD5
762c76c136c918f6c647dcdc40f6b2f3
-
SHA1
c5d3cfdfedac8cb8c4947bf26a4e0a0bba87e87e
-
SHA256
8fd29d1d962db08395a002bb5aff7c87f63d90d9a9944787f0e1c09011749b8f
-
SHA512
3e0747790138c02572e53b811de9fc21eafef68acd03d1d124529ad1e4c99ca9a2bfd38de2c7c133405c4de1ffcf0562651eeaa3d401113c653af118186d3bdc
-
SSDEEP
49152:kcD54XQyecauzXbxNcCLN6hPnKzYdnDoM0hxd7u:kS5yjXBBohPnKwDa3dy
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score3/10 -
-
-
Target
$PLUGINSDIR/tkDecript.dll
-
Size
222KB
-
MD5
ea79ad436f5e54ee5dc2aba13fe1b15a
-
SHA1
66e248962bfb1f370796dac393621367638c21b1
-
SHA256
0ae09d65f5284409e6d9a2d40d7aaa8cbf1dd1815e67a9c12a9557f5de1f7832
-
SHA512
dbd40403126c6ef6f5747c900809140c8897376f03696247cd8d10431bec7abb0c7191761e8ea551cfde2234059ec087ffbca54510ddf0dc78b8329f598fab2e
-
SSDEEP
3072:db0IC6Lh2wWcNA5ZX9VZo6w+ck5yUbTIQ2npANCrYJ5+S+cHOZjvqte36wI1:db0GLhqa8ZorcyQiTrcwZjiu6wi
Score3/10 -
-
-
Target
$TEMP/$_0_
-
Size
2.1MB
-
MD5
271323431d2b405dd0e4d35e03f14d58
-
SHA1
29e6fe0d1a06c40223de3349489fe5794d4898d9
-
SHA256
f6136ed106dbd21e5adbb077286c7efce7fa9df2367c4e0bb8d8ce25d800d147
-
SHA512
b32ba5a4e48d870fac8042f774a469fa3dad37b678f4823a09132085cb648b345d23d27d0bb334c813c8d01cfa596feaf954c934877a7618f521447f2c9152ea
-
SSDEEP
49152:SP2J17dqVDfla4r18WSPkWmQu1BifjTvr:SeTdITjYz
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1