ed94916f042d09389b560f0f4818c57e8c5c6c3cfab5a866fb0759af98a6fb18 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

f4faa2731d...18.exe

windows7-x64

f4faa2731d...18.exe

windows10-2004-x64

Sharing

General

Target

f4faa2731de4be0d1d5fd426d5c0edf3_JaffaCakes118
Size

701KB
Sample

240417-egtpqaee4z
MD5

f4faa2731de4be0d1d5fd426d5c0edf3
SHA1

f7268519ff19b8eed72c78010a0671656b47665e
SHA256

ed94916f042d09389b560f0f4818c57e8c5c6c3cfab5a866fb0759af98a6fb18
SHA512

cfe37d88d3ce6c82c684ef90461a216f72681fa041f63fabfa928523b3f20ad7db5c9ded1544fcc45a49554af8929c4c2f5c4ddaf0516f6b8af06fdfb7427a32
SSDEEP

12288:3ZWtI6RkGOB0fOjOB0SE1zRRaMMMMM2MMMMMaD:3uhaGOZOc1zRRaMMMMM2MMMMMM

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f4faa2731de4be0d1d5fd426d5c0edf3_JaffaCakes118.exe

Resource

win7-20240221-en

evasion persistence upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

f4faa2731de4be0d1d5fd426d5c0edf3_JaffaCakes118.exe

Resource

win10v2004-20240412-en

evasion persistence upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  f4faa2731de4be0d1d5fd426d5c0edf3_JaffaCakes118
- Size
  
  701KB
- MD5
  
  f4faa2731de4be0d1d5fd426d5c0edf3
- SHA1
  
  f7268519ff19b8eed72c78010a0671656b47665e
- SHA256
  
  ed94916f042d09389b560f0f4818c57e8c5c6c3cfab5a866fb0759af98a6fb18
- SHA512
  
  cfe37d88d3ce6c82c684ef90461a216f72681fa041f63fabfa928523b3f20ad7db5c9ded1544fcc45a49554af8929c4c2f5c4ddaf0516f6b8af06fdfb7427a32
- SSDEEP
  
  12288:3ZWtI6RkGOB0fOjOB0SE1zRRaMMMMM2MMMMMaD:3uhaGOZOc1zRRaMMMMM2MMMMMM
Score

10^/10

evasion persistence upx
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy