f1c17c47cc9f05d5573576e8bf3fb7ba16a05351c7da606e128133d2195e7be0 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

a092c54e33...18.exe

windows7-x64

a092c54e33...18.exe

windows10-2004-x64

1

Sharing

General

Target

a092c54e333aa6800628dcfcecb439fe_JaffaCakes118
Size

78KB
Sample

240817-a35a5axclb
MD5

a092c54e333aa6800628dcfcecb439fe
SHA1

6ba81474ca3f99d6c5d5693e719102a80c69bb99
SHA256

f1c17c47cc9f05d5573576e8bf3fb7ba16a05351c7da606e128133d2195e7be0
SHA512

daadbf2ef09baad5236bf0657d0eb7f2512b747a905ef90c73d8db3f5ddfdf386db372d845149f66ff7767ad8b697afaf7566754d315133349258fb04054a28d
SSDEEP

1536:PNAfsZVudPzz4Mdf00/F8vJo5zSH1vfkm4TBsXhMVFTY:PNA0ZVudPzzJW0/Ftzy1v8mOcuTY

Score

10^/10

collection discovery persistence privilege_escalation

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a092c54e333aa6800628dcfcecb439fe_JaffaCakes118.exe

Resource

win7-20240704-en

collection discovery persistence privilege_escalation

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

a092c54e333aa6800628dcfcecb439fe_JaffaCakes118.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Malware Config

Targets

- Target
  
  a092c54e333aa6800628dcfcecb439fe_JaffaCakes118
- Size
  
  78KB
- MD5
  
  a092c54e333aa6800628dcfcecb439fe
- SHA1
  
  6ba81474ca3f99d6c5d5693e719102a80c69bb99
- SHA256
  
  f1c17c47cc9f05d5573576e8bf3fb7ba16a05351c7da606e128133d2195e7be0
- SHA512
  
  daadbf2ef09baad5236bf0657d0eb7f2512b747a905ef90c73d8db3f5ddfdf386db372d845149f66ff7767ad8b697afaf7566754d315133349258fb04054a28d
- SSDEEP
  
  1536:PNAfsZVudPzz4Mdf00/F8vJo5zSH1vfkm4TBsXhMVFTY:PNA0ZVudPzzJW0/Ftzy1v8mOcuTY
Score

10^/10

collection discovery persistence privilege_escalation
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

AppInit DLLs

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoverypersistenceprivilege_escalation

behavioral2

© 2018-2025

Terms | Privacy