1f08385fead6a4145e98018a722009ef1985c3282f8587d356c8d649f8327974 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

e94fcbfaae...18.exe

windows7-x64

e94fcbfaae...18.exe

windows10-2004-x64

Sharing

General

Target

e94fcbfaae370cea9df1140e583e789c_JaffaCakes118
Size

327KB
Sample

240409-f1f4eaff53
MD5

e94fcbfaae370cea9df1140e583e789c
SHA1

a1e14418c878f33c12f52a7f98d2cd8910441543
SHA256

1f08385fead6a4145e98018a722009ef1985c3282f8587d356c8d649f8327974
SHA512

17f7a8a2febfc9d5119759e10d1ae2eab48e71d12a7dba79e49bf5c7a941a451f0984782cc8e1ad1500f9c0f7e4763f49b29ab9aaafb0acde5a5bb442eee1bc1
SSDEEP

6144:WEvcq2IemoKZHrXxjGENss+p1qskL6b65kmmjujUzugJxD8vajJiTUd:lUdIe5KhrBqWss+p1qskGbjAUzualDJ

Score

10^/10

evasion persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e94fcbfaae370cea9df1140e583e789c_JaffaCakes118.exe

Resource

win7-20240221-en

evasion persistence trojan upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

e94fcbfaae370cea9df1140e583e789c_JaffaCakes118.exe

Resource

win10v2004-20240226-en

persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  e94fcbfaae370cea9df1140e583e789c_JaffaCakes118
- Size
  
  327KB
- MD5
  
  e94fcbfaae370cea9df1140e583e789c
- SHA1
  
  a1e14418c878f33c12f52a7f98d2cd8910441543
- SHA256
  
  1f08385fead6a4145e98018a722009ef1985c3282f8587d356c8d649f8327974
- SHA512
  
  17f7a8a2febfc9d5119759e10d1ae2eab48e71d12a7dba79e49bf5c7a941a451f0984782cc8e1ad1500f9c0f7e4763f49b29ab9aaafb0acde5a5bb442eee1bc1
- SSDEEP
  
  6144:WEvcq2IemoKZHrXxjGENss+p1qskL6b65kmmjujUzugJxD8vajJiTUd:lUdIe5KhrBqWss+p1qskGbjAUzualDJ
Score

10^/10

evasion persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Installed Components in the registry
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

© 2018-2025

Terms | Privacy