Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_2ae997066fa48e384c86905e188d016a82d1f1b4e5c2d73d03770413214a3a8e

  • Size

    1.3MB

  • Sample

    241222-l9rjdsvjgm

  • MD5

    112af2cbc851f200a8ad915c0fa3fd5e

  • SHA1

    b5af95d4ff66f2725249d932df7db4a6c1c0afbd

  • SHA256

    2ae997066fa48e384c86905e188d016a82d1f1b4e5c2d73d03770413214a3a8e

  • SHA512

    fc55a95588f8a1db633aa51711ff801f7d364988fc9ce87b23e805f7f6afcecd06735c8e0c23dc890cb8d091139953108424a429c1cfb6fc0f8922e192772c28

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_2ae997066fa48e384c86905e188d016a82d1f1b4e5c2d73d03770413214a3a8e

    • Size

      1.3MB

    • MD5

      112af2cbc851f200a8ad915c0fa3fd5e

    • SHA1

      b5af95d4ff66f2725249d932df7db4a6c1c0afbd

    • SHA256

      2ae997066fa48e384c86905e188d016a82d1f1b4e5c2d73d03770413214a3a8e

    • SHA512

      fc55a95588f8a1db633aa51711ff801f7d364988fc9ce87b23e805f7f6afcecd06735c8e0c23dc890cb8d091139953108424a429c1cfb6fc0f8922e192772c28

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks