df442bce7867eb04d2d05587dbdd7de144710d201ffb532156748a7f3bac8ff4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

76a486a3ce...18.exe

windows7-x64

76a486a3ce...18.exe

windows10-2004-x64

9

Sharing

General

Target

76a486a3ce83acdba53132f1ad857ae7_JaffaCakes118
Size

716KB
Sample

240727-cfc98szekj
MD5

76a486a3ce83acdba53132f1ad857ae7
SHA1

e79f56abf817e54c2b44df025c5dfa592b950744
SHA256

df442bce7867eb04d2d05587dbdd7de144710d201ffb532156748a7f3bac8ff4
SHA512

f862aee17e78dc4863bcf58151a2ddaf15994072e7503cd443c8ec0ece1950adf455af4e5bf59b0d934338a78ec51ae6a4ab25d2f3370bfb375f47aabf974ecc
SSDEEP

12288:LrgNANdEly2170FRY7kq5rfE5DWcoRdXu7Z4Wp9CbYXUR8L:QIur17YNKfEB3oK4Wp9CbRu

Score

10^/10

bootkit discovery persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

76a486a3ce83acdba53132f1ad857ae7_JaffaCakes118.exe

Resource

win7-20240704-en

bootkit discovery persistence upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

76a486a3ce83acdba53132f1ad857ae7_JaffaCakes118.exe

Resource

win10v2004-20240709-en

bootkit discovery persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  76a486a3ce83acdba53132f1ad857ae7_JaffaCakes118
- Size
  
  716KB
- MD5
  
  76a486a3ce83acdba53132f1ad857ae7
- SHA1
  
  e79f56abf817e54c2b44df025c5dfa592b950744
- SHA256
  
  df442bce7867eb04d2d05587dbdd7de144710d201ffb532156748a7f3bac8ff4
- SHA512
  
  f862aee17e78dc4863bcf58151a2ddaf15994072e7503cd443c8ec0ece1950adf455af4e5bf59b0d934338a78ec51ae6a4ab25d2f3370bfb375f47aabf974ecc
- SSDEEP
  
  12288:LrgNANdEly2170FRY7kq5rfE5DWcoRdXu7Z4Wp9CbYXUR8L:QIur17YNKfEB3oK4Wp9CbRu
Score

10^/10

bootkit discovery persistence upx
- Suspicious use of NtCreateProcessOtherParentProcess
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Deletes itself
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistenceupx

behavioral2

bootkitdiscoverypersistenceupx

© 2018-2025

Terms | Privacy