Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Texture Hack v1.0.exe

windows7-x64

10

Texture Hack v1.0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_61c35b535fc9fad10ca9900ed1342ee1

  • Size

    1.3MB

  • Sample

    250310-2lgmaa1lx7

  • MD5

    61c35b535fc9fad10ca9900ed1342ee1

  • SHA1

    3023aa57ce063fdeb4b6275510ed41b4dbee6556

  • SHA256

    be4c88126db70f233b2473296c105005bb4534648ec8a675bc9684069df42a64

  • SHA512

    9683eb4bc80ed7b3c8bc3a730c6ca24a51130840b0352c9003a621b6a429ba7016204d495e105d7986596391969a86557f36286f2a69e5cf0f10bbd1068280cb

  • SSDEEP

    24576:4ZOAaHKJHvmd3nkXLMJvsv4BIdtbZzrn8C+xJY9BmdCyG/n8WbBut:45pJHvmd3khvTibxJYkCzFtut

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      Texture Hack v1.0.exe

    • Size

      2.1MB

    • MD5

      5b627841318eaf4a4004e8eb2cbd0c79

    • SHA1

      c9cbaf247bfaf00dde1c8e7449eaf4405c0abbb4

    • SHA256

      d0fc1a037367a270c4c492009fa70f5b1555d607f71e7d5b7a315663337299fd

    • SHA512

      06d1fccc81becd03c877afc7213655d090462e10226c613e36099049a53ed12345888d9c0a4eef6dab45e5695ad4487b6a97acb731cfabef892639bc25d42ff4

    • SSDEEP

      24576:Tes+IfNgBG4YF4dk4IF8qpan8ZhJQy/yObHS8E8KWZHkrlyePXx4BAp:TesXSgXDpXhJI

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistencerat

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks