Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4f205d008daf67a72f2cc68194b1e4af_JaffaCakes118

  • Size

    138KB

  • Sample

    240331-gsy5pafe99

  • MD5

    4f205d008daf67a72f2cc68194b1e4af

  • SHA1

    d36ec522d8a28b461cb479cd7dbeae031dc13d9c

  • SHA256

    d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac

  • SHA512

    49777416fcbf07f2da627d8e23e7de3af884b6d31fcfb856b4a3a6dd738fe47488335a2e05bfd19a62dd3c6f1b6d77d1a3e2fc258dd6c90a27ff29597dbdf645

  • SSDEEP

    3072:Ek3hOdsylKlgxopeiBNhZFGzE+cL2kdARc6YehWfGvtUHKGDbpmsii2+mZyAqgI8:Ek3hOdsylKlgxopeiBNhZF+E+W2kdARN

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://185.244.150.146/45382.2533795139.dat

xlm40.dropper

http://178.23.190.242/45382.2533795139.dat

xlm40.dropper

http://23.106.124.53/45382.2533795139.dat

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://185.244.150.146/45382.2533153935.dat

xlm40.dropper

http://178.23.190.242/45382.2533153935.dat

xlm40.dropper

http://23.106.124.53/45382.2533153935.dat

Targets

    • Target

      4f205d008daf67a72f2cc68194b1e4af_JaffaCakes118

    • Size

      138KB

    • MD5

      4f205d008daf67a72f2cc68194b1e4af

    • SHA1

      d36ec522d8a28b461cb479cd7dbeae031dc13d9c

    • SHA256

      d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac

    • SHA512

      49777416fcbf07f2da627d8e23e7de3af884b6d31fcfb856b4a3a6dd738fe47488335a2e05bfd19a62dd3c6f1b6d77d1a3e2fc258dd6c90a27ff29597dbdf645

    • SSDEEP

      3072:Ek3hOdsylKlgxopeiBNhZFGzE+cL2kdARc6YehWfGvtUHKGDbpmsii2+mZyAqgI8:Ek3hOdsylKlgxopeiBNhZF+E+W2kdARN

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks