Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_10c4d9a3e9bcd4824db412fca209366f6fb36204c151f96d49d6183af1e79b5f

  • Size

    4.5MB

  • Sample

    241223-qx27ks1lbx

  • MD5

    d20cc28a91570c3efefd749cb7ae3caa

  • SHA1

    c83780b90ed77db2cb101673ccbce50b9d41fe16

  • SHA256

    10c4d9a3e9bcd4824db412fca209366f6fb36204c151f96d49d6183af1e79b5f

  • SHA512

    2f1df6ab84c49bc4dc00948c0befbfe25fbe564c70ac4eaa2d35a6c205dfc99bf01fca6a6d97ef455784727e469715074d830958d14dc990b87d0cc9681f30ae

  • SSDEEP

    98304:RS8qGhiyOwPYVO8JOpZ6qlofdOQJfiAhyqSh0sr/WUDqAz1gmjn/k4n6:RDqGw9wPsOIOjQU41g/p/Wizlct

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Targets

    • Target

      JaffaCakes118_10c4d9a3e9bcd4824db412fca209366f6fb36204c151f96d49d6183af1e79b5f

    • Size

      4.5MB

    • MD5

      d20cc28a91570c3efefd749cb7ae3caa

    • SHA1

      c83780b90ed77db2cb101673ccbce50b9d41fe16

    • SHA256

      10c4d9a3e9bcd4824db412fca209366f6fb36204c151f96d49d6183af1e79b5f

    • SHA512

      2f1df6ab84c49bc4dc00948c0befbfe25fbe564c70ac4eaa2d35a6c205dfc99bf01fca6a6d97ef455784727e469715074d830958d14dc990b87d0cc9681f30ae

    • SSDEEP

      98304:RS8qGhiyOwPYVO8JOpZ6qlofdOQJfiAhyqSh0sr/WUDqAz1gmjn/k4n6:RDqGw9wPsOIOjQU41g/p/Wizlct

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba family

    • Glupteba payload

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.