5c4d0962a9e5ffc28a0bf8d3951e9017d3a639f80d2c2a2912fb0d8190fe81b2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

619b6486f1...18.exe

windows7-x64

8

619b6486f1...18.exe

windows10-2004-x64

8

Sharing

General

Target

619b6486f1a4e6451206847951bf9efc_JaffaCakes118
Size

468KB
Sample

240721-15lvnsxdke
MD5

619b6486f1a4e6451206847951bf9efc
SHA1

d37c7529d3565482d5d9e67c1fed6455f2de0669
SHA256

5c4d0962a9e5ffc28a0bf8d3951e9017d3a639f80d2c2a2912fb0d8190fe81b2
SHA512

ed003ef65b45174c1b2729ef6c6123a842d5a62ff057614a0280e7bc39ed4e8bd952fd2032b0a2e04bfa879a2307df52f15f0841b07b298eecf39abfb38f949b
SSDEEP

6144:xKU6TGEOMB9Q7z76B1151BDloXLGkf3aLiqQ2qJzoUa+7+q0EmU/tcmeyo2x3Sf5:xKJgzetovGi5ZkUR77mS2eniMKkBLm

Score

8^/10

adware discovery persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

619b6486f1a4e6451206847951bf9efc_JaffaCakes118.exe

Resource

win7-20240704-en

adware discovery persistence stealer

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

619b6486f1a4e6451206847951bf9efc_JaffaCakes118.exe

Resource

win10v2004-20240709-en

adware discovery persistence stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  619b6486f1a4e6451206847951bf9efc_JaffaCakes118
- Size
  
  468KB
- MD5
  
  619b6486f1a4e6451206847951bf9efc
- SHA1
  
  d37c7529d3565482d5d9e67c1fed6455f2de0669
- SHA256
  
  5c4d0962a9e5ffc28a0bf8d3951e9017d3a639f80d2c2a2912fb0d8190fe81b2
- SHA512
  
  ed003ef65b45174c1b2729ef6c6123a842d5a62ff057614a0280e7bc39ed4e8bd952fd2032b0a2e04bfa879a2307df52f15f0841b07b298eecf39abfb38f949b
- SSDEEP
  
  6144:xKU6TGEOMB9Q7z76B1151BDloXLGkf3aLiqQ2qJzoUa+7+q0EmU/tcmeyo2x3Sf5:xKJgzetovGi5ZkUR77mS2eniMKkBLm
Score

8^/10

adware discovery persistence stealer
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Browser Extensions

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencestealer

behavioral2

adwarediscoverypersistencestealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.