Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_42c593f7ea822630e71642bde6dc4060
-
Size
111KB
-
Sample
250101-b7scssslfr
-
MD5
42c593f7ea822630e71642bde6dc4060
-
SHA1
947f8a79f6f2ca1a44d7979aba0c4f994766d888
-
SHA256
e71eebadf82c68522a918db2abf6dec4f0095069da5ac43e70c876247c6db82e
-
SHA512
f87cd35ac2c1cf72ef663b78ff151d2fa508685b4076157b173a5d4d1100462b97048ce21081e535528206c29163d5bb605c65acc5386019c50df51ef41dc334
-
SSDEEP
1536:f6uRRfKxFkUPWKPfIxkGZ9nkpi1ce6ygRwbu7rzZpeFMvR2L+tfvfRTNwagrPJ:CuryPjGOieDubu/zUR6pJRwFr
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_42c593f7ea822630e71642bde6dc4060.exe
Resource
win7-20241010-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
JaffaCakes118_42c593f7ea822630e71642bde6dc4060
-
Size
111KB
-
MD5
42c593f7ea822630e71642bde6dc4060
-
SHA1
947f8a79f6f2ca1a44d7979aba0c4f994766d888
-
SHA256
e71eebadf82c68522a918db2abf6dec4f0095069da5ac43e70c876247c6db82e
-
SHA512
f87cd35ac2c1cf72ef663b78ff151d2fa508685b4076157b173a5d4d1100462b97048ce21081e535528206c29163d5bb605c65acc5386019c50df51ef41dc334
-
SSDEEP
1536:f6uRRfKxFkUPWKPfIxkGZ9nkpi1ce6ygRwbu7rzZpeFMvR2L+tfvfRTNwagrPJ:CuryPjGOieDubu/zUR6pJRwFr
-
Modifies firewall policy service
-
Sality family
-
Drops file in Drivers directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5