Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
29d8be9b74b54b5e4c233ecc69425165_JaffaCakes118
-
Size
227KB
-
Sample
240509-n13leagb4v
-
MD5
29d8be9b74b54b5e4c233ecc69425165
-
SHA1
96f1741abac9a5d5ec026bfcd6824ec91c51e8e8
-
SHA256
ebbbf1104be5c5f4f000285e72aa802cdac327750e71a35a101e4ecac224d1d2
-
SHA512
6cbfacb680c5654a8da20b7d62de5044d0b6d6ad48bf36115097f5510bc250c5cbf1b74fba4b5eaf8f13e8c7bd6189bc80b46d4d784c76002961354152ba1cf9
-
SSDEEP
3072:9vYy0u8YGgjv+ZvchmkHcI/o1/Vb6//////////////////////////////////z:X0uXnWFchmmcI/o1/saMdGg0wJAAd
Behavioral task
behavioral1
Sample
29d8be9b74b54b5e4c233ecc69425165_JaffaCakes118.doc
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
29d8be9b74b54b5e4c233ecc69425165_JaffaCakes118.doc
Resource
win10v2004-20240426-en
Malware Config
Extracted
http://nurtandemir.com.tr/n/
http://www.jhomiorganiccotton.com/cgi-bin/qqeO0VU/
http://wit-consul.com/recruit/A7x/
http://www.cedem.com.br/cgi-bin/QaxzC/
http://ozzpot.com/assets/I/
https://xelnetportal.nl/catalog/DyaBD2/
http://premieroneescrow.com/PreOneMap/K/
Targets
-
-
Target
29d8be9b74b54b5e4c233ecc69425165_JaffaCakes118
-
Size
227KB
-
MD5
29d8be9b74b54b5e4c233ecc69425165
-
SHA1
96f1741abac9a5d5ec026bfcd6824ec91c51e8e8
-
SHA256
ebbbf1104be5c5f4f000285e72aa802cdac327750e71a35a101e4ecac224d1d2
-
SHA512
6cbfacb680c5654a8da20b7d62de5044d0b6d6ad48bf36115097f5510bc250c5cbf1b74fba4b5eaf8f13e8c7bd6189bc80b46d4d784c76002961354152ba1cf9
-
SSDEEP
3072:9vYy0u8YGgjv+ZvchmkHcI/o1/Vb6//////////////////////////////////z:X0uXnWFchmmcI/o1/saMdGg0wJAAd
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-