Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    76213d3b0809a3cca7a5d4780be8d4cb_JaffaCakes118

  • Size

    118KB

  • Sample

    241027-1tgrks1lcj

  • MD5

    76213d3b0809a3cca7a5d4780be8d4cb

  • SHA1

    1a2636ca50cbd5d48909d957a8521945634e6415

  • SHA256

    0844b1e0adbf80cc1e36a7be4fbba1eff2aa1ac111d165e6396872dbebc1cc45

  • SHA512

    dc7e1b05ebf5f87fc84438596c3b8b028c99d034ced5c1135f224f2dad0eee718d5255b0f8438547c437f93caad6af27e6eefe403b2b5e98a596b5d20f87a282

  • SSDEEP

    3072:8g+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBn:1+3fRb9NdndPZMT

Malware Config

Targets

    • Target

      76213d3b0809a3cca7a5d4780be8d4cb_JaffaCakes118

    • Size

      118KB

    • MD5

      76213d3b0809a3cca7a5d4780be8d4cb

    • SHA1

      1a2636ca50cbd5d48909d957a8521945634e6415

    • SHA256

      0844b1e0adbf80cc1e36a7be4fbba1eff2aa1ac111d165e6396872dbebc1cc45

    • SHA512

      dc7e1b05ebf5f87fc84438596c3b8b028c99d034ced5c1135f224f2dad0eee718d5255b0f8438547c437f93caad6af27e6eefe403b2b5e98a596b5d20f87a282

    • SSDEEP

      3072:8g+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBn:1+3fRb9NdndPZMT

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • UAC bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks