Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_720a1936eea936359e3f3ef56599f68d
-
Size
344KB
-
Sample
250201-qc8hvstjev
-
MD5
720a1936eea936359e3f3ef56599f68d
-
SHA1
1859681990f7fc8d0cbee45f116108f29e2d99f4
-
SHA256
52ea7fd86dd17fa8304dcc853849e486473f734edc6821e53ff049477e391398
-
SHA512
128fe94ee60072c6c225b10623b4a4616c890934f35df57c04309ef4dc9509f9d7448061b066a0c9a10d3dd53114a5f04f08c221d33dee2a1990c2a420612b66
-
SSDEEP
6144:FrGABDkpgFSiFIg5IN7th9B1BLgEPlZNb+tS8kbPYW:FrGABIgjIgG3rlZNckh
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_720a1936eea936359e3f3ef56599f68d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_720a1936eea936359e3f3ef56599f68d.exe
Resource
win10v2004-20250129-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
JaffaCakes118_720a1936eea936359e3f3ef56599f68d
-
Size
344KB
-
MD5
720a1936eea936359e3f3ef56599f68d
-
SHA1
1859681990f7fc8d0cbee45f116108f29e2d99f4
-
SHA256
52ea7fd86dd17fa8304dcc853849e486473f734edc6821e53ff049477e391398
-
SHA512
128fe94ee60072c6c225b10623b4a4616c890934f35df57c04309ef4dc9509f9d7448061b066a0c9a10d3dd53114a5f04f08c221d33dee2a1990c2a420612b66
-
SSDEEP
6144:FrGABDkpgFSiFIg5IN7th9B1BLgEPlZNb+tS8kbPYW:FrGABIgjIgG3rlZNckh
-
Sality family
-
UAC bypass
-
Windows security bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5