e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

bbf623d929...18.exe

windows7-x64

bbf623d929...18.exe

windows10-2004-x64

7

Sharing

General

Target

bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118
Size

108KB
Sample

240823-qyxcqazckq
MD5

bbf623d9290d3978cded5be9afe6de3a
SHA1

d59cadcc8ef8cb8f9d67e402c698872f0425153f
SHA256

e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994
SHA512

2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832
SSDEEP

3072:S01G98h0qXYvDNL4KQkL2OsINxhc5bZHhsVMh:ZPJYrNL1Qk7Nc5bnh

Score

10^/10

credential_access discovery evasion spyware stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Resource

win7-20240729-en

credential_access discovery evasion spyware stealer upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118.exe

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  bbf623d9290d3978cded5be9afe6de3a_JaffaCakes118
- Size
  
  108KB
- MD5
  
  bbf623d9290d3978cded5be9afe6de3a
- SHA1
  
  d59cadcc8ef8cb8f9d67e402c698872f0425153f
- SHA256
  
  e26efcefcacd60b0a30deec4c349bd0f7db3f9264eb92b35235e618c2111a994
- SHA512
  
  2808bb3b5323a93443f522bbec385228e9a34a1b4430b75560a80b33a9054e111903e44f8816545e649b63e8d9ff9ebbc41862b4905268708aa0b42f6a8ba832
- SSDEEP
  
  3072:S01G98h0qXYvDNL4KQkL2OsINxhc5bZHhsVMh:ZPJYrNL1Qk7Nc5bnh
Score

10^/10

credential_access discovery evasion spyware stealer upx
- Modifies firewall policy service
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoveryevasionspywarestealerupx

behavioral2

© 2018-2025

Terms | Privacy