57a28990a11192cb3db3bd8d5ada2a40ab464b580ffa114e23d162e47dc7624c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

1751a43c98...18.exe

windows7-x64

8

1751a43c98...18.exe

windows10-2004-x64

8

Sharing

General

Target

1751a43c98e70961ed9d4ef3ce4d9746_JaffaCakes118
Size

250KB
Sample

240627-ymp39szemn
MD5

1751a43c98e70961ed9d4ef3ce4d9746
SHA1

f17f5aad083cb5bb6eed5e70ac83abce9fb2bc77
SHA256

57a28990a11192cb3db3bd8d5ada2a40ab464b580ffa114e23d162e47dc7624c
SHA512

edcc40310de7f1d52d705c897dfd1154031f30fda26e72d776b1aef7e961ab001b02a290a8eedde6df0ec89fdcbce08c6e417626c6e4a8da9b3ea994875d2e5e
SSDEEP

6144:AhieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:BeKrJJuf86AYcwoaoSbr

Score

8^/10

execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

1751a43c98e70961ed9d4ef3ce4d9746_JaffaCakes118.exe

Resource

win7-20240611-en

execution persistence upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

1751a43c98e70961ed9d4ef3ce4d9746_JaffaCakes118.exe

Resource

win10v2004-20240611-en

execution persistence upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  1751a43c98e70961ed9d4ef3ce4d9746_JaffaCakes118
- Size
  
  250KB
- MD5
  
  1751a43c98e70961ed9d4ef3ce4d9746
- SHA1
  
  f17f5aad083cb5bb6eed5e70ac83abce9fb2bc77
- SHA256
  
  57a28990a11192cb3db3bd8d5ada2a40ab464b580ffa114e23d162e47dc7624c
- SHA512
  
  edcc40310de7f1d52d705c897dfd1154031f30fda26e72d776b1aef7e961ab001b02a290a8eedde6df0ec89fdcbce08c6e417626c6e4a8da9b3ea994875d2e5e
- SSDEEP
  
  6144:AhieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:BeKrJJuf86AYcwoaoSbr
Score

8^/10

execution persistence upx
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistenceupx

behavioral2

executionpersistenceupx

© 2018-2025

Terms | Privacy