Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118

  • Size

    139KB

  • Sample

    240402-h9bw6aah5t

  • MD5

    863973df5c9a7a470e1bca5c58d57fea

  • SHA1

    ce636d2f49953d37c60358d8f7af898121b7fb14

  • SHA256

    024361c1adbe097b5d58454a74d1061e89f6907f16966b1667353ff516fd2abc

  • SHA512

    139442fefff948b17643434d5d814acf36c2098a8e678d6a58b6dd136b7c065255b5196aa73cd2d9d4fd86fb0754d70b94a82d9013f396d177c633cf275ba6ec

  • SSDEEP

    3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://190.14.37.202/45384.3096516204.dat

xlm40.dropper

http://94.140.112.142/45384.3096516204.dat

xlm40.dropper

http://185.244.150.174/45384.3096516204.dat

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://190.14.37.202/45384.3097987268.dat

xlm40.dropper

http://94.140.112.142/45384.3097987268.dat

xlm40.dropper

http://185.244.150.174/45384.3097987268.dat

Targets

    • Target

      863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118

    • Size

      139KB

    • MD5

      863973df5c9a7a470e1bca5c58d57fea

    • SHA1

      ce636d2f49953d37c60358d8f7af898121b7fb14

    • SHA256

      024361c1adbe097b5d58454a74d1061e89f6907f16966b1667353ff516fd2abc

    • SHA512

      139442fefff948b17643434d5d814acf36c2098a8e678d6a58b6dd136b7c065255b5196aa73cd2d9d4fd86fb0754d70b94a82d9013f396d177c633cf275ba6ec

    • SSDEEP

      3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks