99d8b77ef4a32159a8581cb99b234b2952f9e7d0f6ea2018524b4ca47a2c8d4d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

088fb015b5...18.exe

windows7-x64

8

088fb015b5...18.exe

windows10-2004-x64

8

Sharing

General

Target

088fb015b5add247137b27e402d61441_JaffaCakes118
Size

250KB
Sample

240624-pwj4yasdqe
MD5

088fb015b5add247137b27e402d61441
SHA1

3536172939a18651a1f85ac6e1dc42638f0136d0
SHA256

99d8b77ef4a32159a8581cb99b234b2952f9e7d0f6ea2018524b4ca47a2c8d4d
SHA512

e2a15131e4aaf8251852d9dfddc71918702f15ae4d320182be122f5ac2dad2a9f239db93a588cfc95dfe2dcc073932c5020bce27f37fb4460b4d018e2ef9b49c
SSDEEP

6144:ghieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:heKrJJuf86AYcwoaoSbr

Score

8^/10

execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

088fb015b5add247137b27e402d61441_JaffaCakes118.exe

Resource

win7-20240508-en

execution persistence upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

088fb015b5add247137b27e402d61441_JaffaCakes118.exe

Resource

win10v2004-20240508-en

execution persistence upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  088fb015b5add247137b27e402d61441_JaffaCakes118
- Size
  
  250KB
- MD5
  
  088fb015b5add247137b27e402d61441
- SHA1
  
  3536172939a18651a1f85ac6e1dc42638f0136d0
- SHA256
  
  99d8b77ef4a32159a8581cb99b234b2952f9e7d0f6ea2018524b4ca47a2c8d4d
- SHA512
  
  e2a15131e4aaf8251852d9dfddc71918702f15ae4d320182be122f5ac2dad2a9f239db93a588cfc95dfe2dcc073932c5020bce27f37fb4460b4d018e2ef9b49c
- SSDEEP
  
  6144:ghieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:heKrJJuf86AYcwoaoSbr
Score

8^/10

execution persistence upx
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistenceupx

behavioral2

executionpersistenceupx

© 2018-2025

Terms | Privacy