67951cd3177846e0c9d99d2f148ce50f835d718ad53448001509da50b37a38c3 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

2273a11261...18.exe

windows7-x64

7

2273a11261...18.exe

windows10-2004-x64

7

Sharing

General

Target

2273a11261b6eabfdd4b368cc28e3426_JaffaCakes118
Size

87KB
Sample

240703-p9agnawhpe
MD5

2273a11261b6eabfdd4b368cc28e3426
SHA1

242d7af2331623ecf69577908170f49868928343
SHA256

67951cd3177846e0c9d99d2f148ce50f835d718ad53448001509da50b37a38c3
SHA512

683328a8049271f3a90dd37a10f23e21d0747dff45ac504a1987ecfcc5ceb1c26efd9444d49b27dce08afd37dfe6fd69fcd8062f1c7fd64c87a58bfba82301d4
SSDEEP

1536:XsfXh6Zcb2Ihf8ujMyPMb2xbh5ms9GfZdQ7UBzqqB0lRGQpE+A6O4w2nvX:cfXh6Zcb2Of7MWTms9sdjVX0lQQpRlTT

Score

7^/10

adware discovery persistence stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2273a11261b6eabfdd4b368cc28e3426_JaffaCakes118.exe

Resource

win7-20240611-en

adware discovery persistence stealer upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

2273a11261b6eabfdd4b368cc28e3426_JaffaCakes118.exe

Resource

win10v2004-20240508-en

adware discovery persistence stealer upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  2273a11261b6eabfdd4b368cc28e3426_JaffaCakes118
- Size
  
  87KB
- MD5
  
  2273a11261b6eabfdd4b368cc28e3426
- SHA1
  
  242d7af2331623ecf69577908170f49868928343
- SHA256
  
  67951cd3177846e0c9d99d2f148ce50f835d718ad53448001509da50b37a38c3
- SHA512
  
  683328a8049271f3a90dd37a10f23e21d0747dff45ac504a1987ecfcc5ceb1c26efd9444d49b27dce08afd37dfe6fd69fcd8062f1c7fd64c87a58bfba82301d4
- SSDEEP
  
  1536:XsfXh6Zcb2Ihf8ujMyPMb2xbh5ms9GfZdQ7UBzqqB0lRGQpE+A6O4w2nvX:cfXh6Zcb2Of7MWTms9sdjVX0lQQpRlTT
Score

7^/10

adware discovery persistence stealer upx
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealerupx

behavioral2

adwarediscoverypersistencestealerupx

© 2018-2025

Terms | Privacy