Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118

  • Size

    1.8MB

  • Sample

    241027-11ntga1ncw

  • MD5

    762c76c136c918f6c647dcdc40f6b2f3

  • SHA1

    c5d3cfdfedac8cb8c4947bf26a4e0a0bba87e87e

  • SHA256

    8fd29d1d962db08395a002bb5aff7c87f63d90d9a9944787f0e1c09011749b8f

  • SHA512

    3e0747790138c02572e53b811de9fc21eafef68acd03d1d124529ad1e4c99ca9a2bfd38de2c7c133405c4de1ffcf0562651eeaa3d401113c653af118186d3bdc

  • SSDEEP

    49152:kcD54XQyecauzXbxNcCLN6hPnKzYdnDoM0hxd7u:kS5yjXBBohPnKwDa3dy

Malware Config

Targets

    • Target

      762c76c136c918f6c647dcdc40f6b2f3_JaffaCakes118

    • Size

      1.8MB

    • MD5

      762c76c136c918f6c647dcdc40f6b2f3

    • SHA1

      c5d3cfdfedac8cb8c4947bf26a4e0a0bba87e87e

    • SHA256

      8fd29d1d962db08395a002bb5aff7c87f63d90d9a9944787f0e1c09011749b8f

    • SHA512

      3e0747790138c02572e53b811de9fc21eafef68acd03d1d124529ad1e4c99ca9a2bfd38de2c7c133405c4de1ffcf0562651eeaa3d401113c653af118186d3bdc

    • SSDEEP

      49152:kcD54XQyecauzXbxNcCLN6hPnKzYdnDoM0hxd7u:kS5yjXBBohPnKwDa3dy

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      c17103ae9072a06da581dec998343fc1

    • SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    • SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    • SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    • Target

      $PLUGINSDIR/tkDecript.dll

    • Size

      222KB

    • MD5

      ea79ad436f5e54ee5dc2aba13fe1b15a

    • SHA1

      66e248962bfb1f370796dac393621367638c21b1

    • SHA256

      0ae09d65f5284409e6d9a2d40d7aaa8cbf1dd1815e67a9c12a9557f5de1f7832

    • SHA512

      dbd40403126c6ef6f5747c900809140c8897376f03696247cd8d10431bec7abb0c7191761e8ea551cfde2234059ec087ffbca54510ddf0dc78b8329f598fab2e

    • SSDEEP

      3072:db0IC6Lh2wWcNA5ZX9VZo6w+ck5yUbTIQ2npANCrYJ5+S+cHOZjvqte36wI1:db0GLhqa8ZorcyQiTrcwZjiu6wi

    Score
    3/10
    • Target

      $TEMP/$_0_

    • Size

      2.1MB

    • MD5

      271323431d2b405dd0e4d35e03f14d58

    • SHA1

      29e6fe0d1a06c40223de3349489fe5794d4898d9

    • SHA256

      f6136ed106dbd21e5adbb077286c7efce7fa9df2367c4e0bb8d8ce25d800d147

    • SHA512

      b32ba5a4e48d870fac8042f774a469fa3dad37b678f4823a09132085cb648b345d23d27d0bb334c813c8d01cfa596feaf954c934877a7618f521447f2c9152ea

    • SSDEEP

      49152:SP2J17dqVDfla4r18WSPkWmQu1BifjTvr:SeTdITjYz

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks