9b6247e71ab6026c5622b3b27627205072ce2bc6ac7043fc1d27d13261faa9cd | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

eb1f0d66d8...18.exe

windows7-x64

7

eb1f0d66d8...18.exe

windows10-2004-x64

7

Sharing

General

Target

eb1f0d66d83d6c92aca7f5488487c606_JaffaCakes118
Size

89KB
Sample

240919-maz7xstakf
MD5

eb1f0d66d83d6c92aca7f5488487c606
SHA1

1eb75c48fabbb85894ded839e6a6da73a702d594
SHA256

9b6247e71ab6026c5622b3b27627205072ce2bc6ac7043fc1d27d13261faa9cd
SHA512

6de9c5d7fbd28f51682c72ef40178a3a8beda48ec165cae2a0d4510d28335dac979265d449d8e3a397b881f2d9c714fe5de18d9832e449edce6e517128180cd2
SSDEEP

1536:20sq3eLAW97ti/usXNuAdQgYK/qlhvnNTslSAg75FShpRrufceK+ZCl:gd97ti/39UR6q/NTsleHSnVhV+ZCl

Score

7^/10

discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

eb1f0d66d83d6c92aca7f5488487c606_JaffaCakes118.exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

eb1f0d66d83d6c92aca7f5488487c606_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery persistence

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  eb1f0d66d83d6c92aca7f5488487c606_JaffaCakes118
- Size
  
  89KB
- MD5
  
  eb1f0d66d83d6c92aca7f5488487c606
- SHA1
  
  1eb75c48fabbb85894ded839e6a6da73a702d594
- SHA256
  
  9b6247e71ab6026c5622b3b27627205072ce2bc6ac7043fc1d27d13261faa9cd
- SHA512
  
  6de9c5d7fbd28f51682c72ef40178a3a8beda48ec165cae2a0d4510d28335dac979265d449d8e3a397b881f2d9c714fe5de18d9832e449edce6e517128180cd2
- SSDEEP
  
  1536:20sq3eLAW97ti/usXNuAdQgYK/qlhvnNTslSAg75FShpRrufceK+ZCl:gd97ti/39UR6q/NTsleHSnVhV+ZCl
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.