Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118
-
Size
139KB
-
Sample
240402-h9bw6aah5t
-
MD5
863973df5c9a7a470e1bca5c58d57fea
-
SHA1
ce636d2f49953d37c60358d8f7af898121b7fb14
-
SHA256
024361c1adbe097b5d58454a74d1061e89f6907f16966b1667353ff516fd2abc
-
SHA512
139442fefff948b17643434d5d814acf36c2098a8e678d6a58b6dd136b7c065255b5196aa73cd2d9d4fd86fb0754d70b94a82d9013f396d177c633cf275ba6ec
-
SSDEEP
3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv
Behavioral task
behavioral1
Sample
863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118.xls
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118.xls
Resource
win10v2004-20240226-en
Malware Config
Extracted
http://190.14.37.202/45384.3096516204.dat
http://94.140.112.142/45384.3096516204.dat
http://185.244.150.174/45384.3096516204.dat
Extracted
http://190.14.37.202/45384.3097987268.dat
http://94.140.112.142/45384.3097987268.dat
http://185.244.150.174/45384.3097987268.dat
Targets
-
-
Target
863973df5c9a7a470e1bca5c58d57fea_JaffaCakes118
-
Size
139KB
-
MD5
863973df5c9a7a470e1bca5c58d57fea
-
SHA1
ce636d2f49953d37c60358d8f7af898121b7fb14
-
SHA256
024361c1adbe097b5d58454a74d1061e89f6907f16966b1667353ff516fd2abc
-
SHA512
139442fefff948b17643434d5d814acf36c2098a8e678d6a58b6dd136b7c065255b5196aa73cd2d9d4fd86fb0754d70b94a82d9013f396d177c633cf275ba6ec
-
SSDEEP
3072:ak3hOdsylKlgxopeiBNhZFGzE+cL2kdAWc6YehWfGjtUHKGDbpmsiifnSIn0K+l9:ak3hOdsylKlgxopeiBNhZF+E+W2kdAWv
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-