875b0094f5ed75e2c85bdce3c5d4e18116dc788ba156febf5f903072294e383b | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

82394930e7...18.exe

windows7-x64

7

82394930e7...18.exe

windows10-2004-x64

7

Sharing

General

Target

82394930e7babddd90b8eee3610e31e1_JaffaCakes118
Size

121KB
Sample

240801-3v3rjstaql
MD5

82394930e7babddd90b8eee3610e31e1
SHA1

1edd69f96c7ffcf818abb95aa5903a71bac60b12
SHA256

875b0094f5ed75e2c85bdce3c5d4e18116dc788ba156febf5f903072294e383b
SHA512

45082d41b76a2d3f8f2a6c99ecfec951087a0be69201a1bf2956b880c6393f071071fb2705ea9faf7df50c5574d6f4034ea5b64d6496ef4e79af856a464d039e
SSDEEP

1536:thivqRTLZQVgiVQXmxFsEtE890oiSSPjewOYlk15Ds+8yH2W3YtGVfBSBz12rCfH:/kie2Otg84SSPLOz8i2QY8Vfs7jz

Score

7^/10

defense_evasion discovery upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

82394930e7babddd90b8eee3610e31e1_JaffaCakes118.exe

Resource

win7-20240708-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

82394930e7babddd90b8eee3610e31e1_JaffaCakes118.exe

Resource

win10v2004-20240730-en

defense_evasion discovery upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  82394930e7babddd90b8eee3610e31e1_JaffaCakes118
- Size
  
  121KB
- MD5
  
  82394930e7babddd90b8eee3610e31e1
- SHA1
  
  1edd69f96c7ffcf818abb95aa5903a71bac60b12
- SHA256
  
  875b0094f5ed75e2c85bdce3c5d4e18116dc788ba156febf5f903072294e383b
- SHA512
  
  45082d41b76a2d3f8f2a6c99ecfec951087a0be69201a1bf2956b880c6393f071071fb2705ea9faf7df50c5574d6f4034ea5b64d6496ef4e79af856a464d039e
- SSDEEP
  
  1536:thivqRTLZQVgiVQXmxFsEtE890oiSSPjewOYlk15Ds+8yH2W3YtGVfBSBz12rCfH:/kie2Otg84SSPLOz8i2QY8Vfs7jz
Score

7^/10

discovery upx defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

defense_evasiondiscoveryupx

© 2018-2025

Terms | Privacy