88431e76440b94fd1c0daa199e615374c180bc2934d4c663996245608a2abf45 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

a5e42233c4...18.exe

windows7-x64

7

a5e42233c4...18.exe

windows10-2004-x64

7

Sharing

General

Target

a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118
Size

3.6MB
Sample

240818-h89f2avhpq
MD5

a5e42233c487aeb5f4fdf707c3d7d0e2
SHA1

620605482c4d52766b9e0dce8c7af931ece2d2e0
SHA256

88431e76440b94fd1c0daa199e615374c180bc2934d4c663996245608a2abf45
SHA512

20d0ad0b07397d8b801e971687c52374643283e9cf533b0d477546aa35441c744bd41a833ccbfb139773cc0cc296b59c536d605baa4e740b15668bfe189db951
SSDEEP

49152:MIG5HOL2c1XiVLMIifICpAaZPLfjmHs/zvj6Mzg1SpPCSSDfNjYSqWLBBRwIcCZ:MXH/6SVyICKqJj9zg1iKVj3qIg

Score

7^/10

bootkit discovery persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118.exe

Resource

win7-20240708-en

bootkit discovery persistence upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118
- Size
  
  3.6MB
- MD5
  
  a5e42233c487aeb5f4fdf707c3d7d0e2
- SHA1
  
  620605482c4d52766b9e0dce8c7af931ece2d2e0
- SHA256
  
  88431e76440b94fd1c0daa199e615374c180bc2934d4c663996245608a2abf45
- SHA512
  
  20d0ad0b07397d8b801e971687c52374643283e9cf533b0d477546aa35441c744bd41a833ccbfb139773cc0cc296b59c536d605baa4e740b15668bfe189db951
- SSDEEP
  
  49152:MIG5HOL2c1XiVLMIifICpAaZPLfjmHs/zvj6Mzg1SpPCSSDfNjYSqWLBBRwIcCZ:MXH/6SVyICKqJj9zg1iKVj3qIg
Score

7^/10

bootkit discovery persistence upx
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistenceupx

behavioral2

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.