Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_57e216dd583d1e0bd994370d9cc06add

  • Size

    128KB

  • Sample

    250101-rb8mxaznbk

  • MD5

    57e216dd583d1e0bd994370d9cc06add

  • SHA1

    03bb0870d94181ea3719b32838618dae3d391565

  • SHA256

    2353ca7bfff8ffaaced210c1a51fc804058677b0e5f15ba5fe0b157676cee4b6

  • SHA512

    3b3ae56cafd9eda3c73c3b455b274d5229c5a97f19aeb816b1efa49d7cca2d358e62c1bc1d6cc1379a62dca49c039704ec031373a77c745898d48cc41a482c58

  • SSDEEP

    3072:D9DXmroY9wjVpDFZ/ok8YwiLveB+Qhh04dOQM:DtqsN/vIyWgQh/

Malware Config

Targets

    • Target

      JaffaCakes118_57e216dd583d1e0bd994370d9cc06add

    • Size

      128KB

    • MD5

      57e216dd583d1e0bd994370d9cc06add

    • SHA1

      03bb0870d94181ea3719b32838618dae3d391565

    • SHA256

      2353ca7bfff8ffaaced210c1a51fc804058677b0e5f15ba5fe0b157676cee4b6

    • SHA512

      3b3ae56cafd9eda3c73c3b455b274d5229c5a97f19aeb816b1efa49d7cca2d358e62c1bc1d6cc1379a62dca49c039704ec031373a77c745898d48cc41a482c58

    • SSDEEP

      3072:D9DXmroY9wjVpDFZ/ok8YwiLveB+Qhh04dOQM:DtqsN/vIyWgQh/

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Ramnit family

    • UAC bypass

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks