Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a48c18eb8e4e35b669ed9ea252652fa3_JaffaCakes118

  • Size

    452KB

  • Sample

    241126-2vdxrazqgm

  • MD5

    a48c18eb8e4e35b669ed9ea252652fa3

  • SHA1

    fcd15abd1a4ce7d967c917351ad7390d177d18b4

  • SHA256

    c92da775a6532d11d569a42e704de2fbc42485b29ecc3c90cfa3468d030e174b

  • SHA512

    7641d12dfd62a79ef8472660668f98f151e5af250ef30d95d35bc48a1ca2a643f2bf178e1d2e2d86b3a4f9bafd824660e333d76fe9e10b34309fe3eafaff0e26

  • SSDEEP

    6144:ise2g/+INC7rGN3bkty0Mki8787O71rkhJSammcmZxRL0hb:iZI7rGNrkty0fkhAlmvPKb

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      a48c18eb8e4e35b669ed9ea252652fa3_JaffaCakes118

    • Size

      452KB

    • MD5

      a48c18eb8e4e35b669ed9ea252652fa3

    • SHA1

      fcd15abd1a4ce7d967c917351ad7390d177d18b4

    • SHA256

      c92da775a6532d11d569a42e704de2fbc42485b29ecc3c90cfa3468d030e174b

    • SHA512

      7641d12dfd62a79ef8472660668f98f151e5af250ef30d95d35bc48a1ca2a643f2bf178e1d2e2d86b3a4f9bafd824660e333d76fe9e10b34309fe3eafaff0e26

    • SSDEEP

      6144:ise2g/+INC7rGN3bkty0Mki8787O71rkhJSammcmZxRL0hb:iZI7rGNrkty0fkhAlmvPKb

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks