Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
766baca1f19497fe108e78f598fd529f_JaffaCakes118
-
Size
646KB
-
Sample
241027-24jvcssley
-
MD5
766baca1f19497fe108e78f598fd529f
-
SHA1
ed1165d8b3b3a85a9d38680ebda9769352ba4fc3
-
SHA256
1228cf63d65df4ce4a411bdd200b46a195825f754a73a2d2588a1698c0bca810
-
SHA512
6a6e08591bbee59c61fbfa5d2380ba5300c1422df3b2d9580acb04e9f758e6148d0e6c11067a61c15657356442fb73462341bb9d0180befc0a3f8737be9149b8
-
SSDEEP
12288:k/dr9yql7Xx+mO0FKUDTtMi1NzW/DaRMvNXx265syu4MrZ:kl8qNhyUdMONUzeosyu4M
Static task
static1
Behavioral task
behavioral1
Sample
766baca1f19497fe108e78f598fd529f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
766baca1f19497fe108e78f598fd529f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
766baca1f19497fe108e78f598fd529f_JaffaCakes118
-
Size
646KB
-
MD5
766baca1f19497fe108e78f598fd529f
-
SHA1
ed1165d8b3b3a85a9d38680ebda9769352ba4fc3
-
SHA256
1228cf63d65df4ce4a411bdd200b46a195825f754a73a2d2588a1698c0bca810
-
SHA512
6a6e08591bbee59c61fbfa5d2380ba5300c1422df3b2d9580acb04e9f758e6148d0e6c11067a61c15657356442fb73462341bb9d0180befc0a3f8737be9149b8
-
SSDEEP
12288:k/dr9yql7Xx+mO0FKUDTtMi1NzW/DaRMvNXx265syu4MrZ:kl8qNhyUdMONUzeosyu4M
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1