ea68ac94f7e6b26e48414341681247aa49e75b5cc678b18a2060ebf992d4fbb2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

2a0acf5932...18.exe

windows7-x64

2a0acf5932...18.exe

windows10-2004-x64

Sharing

General

Target

2a0acf5932cc1ff1c1d52be21fbc7184_JaffaCakes118
Size

533KB
Sample

240707-2pxgxascpd
MD5

2a0acf5932cc1ff1c1d52be21fbc7184
SHA1

92962756ded4eefaef1afd7ee0871e4472a09c5f
SHA256

ea68ac94f7e6b26e48414341681247aa49e75b5cc678b18a2060ebf992d4fbb2
SHA512

cede240b560a08c4e2a8c60adba648cd8619317c8a9a67cc9b883db7b6cff3321dc7e25a36f0da63da76c6fd179b67f75337adef8c0f4806ba0981614a97e705
SSDEEP

6144:GWZfec9EbXDk6RkQKf/UOPSe570Szp3Znmy+g4IE2Ernmy+g46nmy+g4H:3ZWtI6RkaOB06arV2

Score

10^/10

evasion execution persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2a0acf5932cc1ff1c1d52be21fbc7184_JaffaCakes118.exe

Resource

win7-20240704-en

evasion execution persistence upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

2a0acf5932cc1ff1c1d52be21fbc7184_JaffaCakes118.exe

Resource

win10v2004-20240704-en

evasion execution persistence upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  2a0acf5932cc1ff1c1d52be21fbc7184_JaffaCakes118
- Size
  
  533KB
- MD5
  
  2a0acf5932cc1ff1c1d52be21fbc7184
- SHA1
  
  92962756ded4eefaef1afd7ee0871e4472a09c5f
- SHA256
  
  ea68ac94f7e6b26e48414341681247aa49e75b5cc678b18a2060ebf992d4fbb2
- SHA512
  
  cede240b560a08c4e2a8c60adba648cd8619317c8a9a67cc9b883db7b6cff3321dc7e25a36f0da63da76c6fd179b67f75337adef8c0f4806ba0981614a97e705
- SSDEEP
  
  6144:GWZfec9EbXDk6RkQKf/UOPSe570Szp3Znmy+g4IE2Ernmy+g46nmy+g4H:3ZWtI6RkaOB06arV2
Score

10^/10

evasion execution persistence upx
- Disables service(s)
  evasion execution
- Modifies visibility of file extensions in Explorer
  evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistenceupx

behavioral2

evasionexecutionpersistenceupx

© 2018-2025

Terms | Privacy