Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_019c4728387407095d9dbaaa3c7f7bfc
-
Size
100KB
-
Sample
241231-dblaqatlcs
-
MD5
019c4728387407095d9dbaaa3c7f7bfc
-
SHA1
cf80d15091c0974b551273c5b46ffbf69f482491
-
SHA256
c19b9bb842c14f50b8188c03c67e7f99ea51100eeb5b916085358b1a22044029
-
SHA512
7315be322f07c9b6c2567c43a46b5ed949bd953b7ef857afa29ecb999aea2cde19f13a1f377160c89332fb5b4224d7aa0516ae22672388a9a6b1211cb177a97e
-
SSDEEP
1536:db5JtNPJ8s0/tCk88ReuRhsUzE4pjt9nnpWu0nM:vJtNPJZ0/tCk8+dRZgmj7
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_019c4728387407095d9dbaaa3c7f7bfc.exe
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
JaffaCakes118_019c4728387407095d9dbaaa3c7f7bfc
-
Size
100KB
-
MD5
019c4728387407095d9dbaaa3c7f7bfc
-
SHA1
cf80d15091c0974b551273c5b46ffbf69f482491
-
SHA256
c19b9bb842c14f50b8188c03c67e7f99ea51100eeb5b916085358b1a22044029
-
SHA512
7315be322f07c9b6c2567c43a46b5ed949bd953b7ef857afa29ecb999aea2cde19f13a1f377160c89332fb5b4224d7aa0516ae22672388a9a6b1211cb177a97e
-
SSDEEP
1536:db5JtNPJ8s0/tCk88ReuRhsUzE4pjt9nnpWu0nM:vJtNPJZ0/tCk8+dRZgmj7
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5