c34ad19b3a108b28563b5c9b40c475b80277eec378d0551441bb79d237f62c1c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

e901ba0526...18.exe

windows7-x64

7

e901ba0526...18.exe

windows10-2004-x64

8

Sharing

General

Target

e901ba0526576f30391a8840e96e1ea1_JaffaCakes118
Size

846KB
Sample

240409-cyrkksbg74
MD5

e901ba0526576f30391a8840e96e1ea1
SHA1

777812c92aa35c4618256d32086bd25bc36d0f04
SHA256

c34ad19b3a108b28563b5c9b40c475b80277eec378d0551441bb79d237f62c1c
SHA512

0163cbcb4f937e0a372db3517d6b79135cfa50de2063e706cc1ca3098717e022fe432372be3d8356408e48e81657bdc47145e0f0cae64af2287a91e929077ee0
SSDEEP

24576:PfG7NQukBxM0xOHNg7a5+29JrJcANaotb4Rzqly5Q5:mxQ7BxmHNg0/9JtcANaoESwQ

Score

8^/10

bootkit persistence spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e901ba0526576f30391a8840e96e1ea1_JaffaCakes118.exe

Resource

win7-20240221-en

bootkit persistence spyware stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

e901ba0526576f30391a8840e96e1ea1_JaffaCakes118.exe

Resource

win10v2004-20240226-en

bootkit persistence

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  e901ba0526576f30391a8840e96e1ea1_JaffaCakes118
- Size
  
  846KB
- MD5
  
  e901ba0526576f30391a8840e96e1ea1
- SHA1
  
  777812c92aa35c4618256d32086bd25bc36d0f04
- SHA256
  
  c34ad19b3a108b28563b5c9b40c475b80277eec378d0551441bb79d237f62c1c
- SHA512
  
  0163cbcb4f937e0a372db3517d6b79135cfa50de2063e706cc1ca3098717e022fe432372be3d8356408e48e81657bdc47145e0f0cae64af2287a91e929077ee0
- SSDEEP
  
  24576:PfG7NQukBxM0xOHNg7a5+29JrJcANaotb4Rzqly5Q5:mxQ7BxmHNg0/9JtcANaoESwQ
Score

8^/10

bootkit persistence spyware stealer
- Modifies Installed Components in the registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealer

behavioral2

bootkitpersistence

© 2018-2025

Terms | Privacy