14935216d45b2e4a4c0883237dadcd4489a2ab1b1e9908f1f54d383523a47012 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

69a8abd71b...18.exe

windows7-x64

8

69a8abd71b...18.exe

windows10-2004-x64

8

Sharing

General

Target

69a8abd71b135b53dbae1c43076902c1_JaffaCakes118
Size

1.0MB
Sample

240724-bbxbwaydnm
MD5

69a8abd71b135b53dbae1c43076902c1
SHA1

d9f5c3c92f1996a972d2a8e2cbfa494a2598d960
SHA256

14935216d45b2e4a4c0883237dadcd4489a2ab1b1e9908f1f54d383523a47012
SHA512

cf06bf6501c0e0124d75189f47e80abd13295377718861d2c584e0b7a8c7d3d17a8713fa9b4a494aa2cafd239613cb6581c4a747c2e2fddedf56c82c8ef71655
SSDEEP

24576:0J94Ob3Cx0i0o6zsday2COaHVHn/e6af4fVjbHomTOyzdI/CMgDb:0Jzyx0bsS2HVHn/VafeVjsuOkdI/M

Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

69a8abd71b135b53dbae1c43076902c1_JaffaCakes118.exe

Resource

win7-20240704-en

defense_evasion discovery evasion persistence privilege_escalation upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

69a8abd71b135b53dbae1c43076902c1_JaffaCakes118.exe

Resource

win10v2004-20240709-en

defense_evasion discovery evasion persistence privilege_escalation upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  69a8abd71b135b53dbae1c43076902c1_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  69a8abd71b135b53dbae1c43076902c1
- SHA1
  
  d9f5c3c92f1996a972d2a8e2cbfa494a2598d960
- SHA256
  
  14935216d45b2e4a4c0883237dadcd4489a2ab1b1e9908f1f54d383523a47012
- SHA512
  
  cf06bf6501c0e0124d75189f47e80abd13295377718861d2c584e0b7a8c7d3d17a8713fa9b4a494aa2cafd239613cb6581c4a747c2e2fddedf56c82c8ef71655
- SSDEEP
  
  24576:0J94Ob3Cx0i0o6zsday2COaHVHn/e6af4fVjbHomTOyzdI/CMgDb:0Jzyx0bsS2HVHn/VafeVjsuOkdI/M
Score

8^/10

defense_evasion discovery evasion persistence privilege_escalation upx
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Access Token Manipulation

Create Process with Token

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Access Token Manipulation

Create Process with Token

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

behavioral2

defense_evasiondiscoveryevasionpersistenceprivilege_escalationupx

© 2018-2025

Terms | Privacy