ea39f5f38bd536757c0f1ec97db474300de7040b3c3f0829d35d4cc8ca140de8 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

dbc24cc44d...18.exe

windows7-x64

dbc24cc44d...18.exe

windows10-2004-x64

Sharing

General

Target

dbc24cc44d3682623968b01659fba77c_JaffaCakes118
Size

56KB
Sample

240912-edwd5szdpl
MD5

dbc24cc44d3682623968b01659fba77c
SHA1

38890157e7e892072c2d66c3687c203e1df5523d
SHA256

ea39f5f38bd536757c0f1ec97db474300de7040b3c3f0829d35d4cc8ca140de8
SHA512

9b487798442f98ce92b4933618073d0a6fd7c8c39e65debc8a80e08eb2a182126d6913cb072269c6f2efbfc7647c36a274e0fdcf8485fd41474f6d01040da8aa
SSDEEP

1536:E0nuJ0pmaxxtP8S5y7xcAzzZFQXV8zm6mWY:E0uJ0caxT8A+vzgyzHmH

Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

dbc24cc44d3682623968b01659fba77c_JaffaCakes118.exe

Resource

win7-20240903-en

defense_evasion discovery evasion execution persistence privilege_escalation upx

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

dbc24cc44d3682623968b01659fba77c_JaffaCakes118.exe

Resource

win10v2004-20240802-en

defense_evasion discovery evasion execution persistence privilege_escalation upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  dbc24cc44d3682623968b01659fba77c_JaffaCakes118
- Size
  
  56KB
- MD5
  
  dbc24cc44d3682623968b01659fba77c
- SHA1
  
  38890157e7e892072c2d66c3687c203e1df5523d
- SHA256
  
  ea39f5f38bd536757c0f1ec97db474300de7040b3c3f0829d35d4cc8ca140de8
- SHA512
  
  9b487798442f98ce92b4933618073d0a6fd7c8c39e65debc8a80e08eb2a182126d6913cb072269c6f2efbfc7647c36a274e0fdcf8485fd41474f6d01040da8aa
- SSDEEP
  
  1536:E0nuJ0pmaxxtP8S5y7xcAzzZFQXV8zm6mWY:E0uJ0caxT8A+vzgyzHmH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation upx
- Disables service(s)
  evasion execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

AppInit DLLs

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

AppInit DLLs

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationupx

behavioral2

defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationupx

© 2018-2025

Terms | Privacy