Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
745db86a63082c422777fb646723ab1d_JaffaCakes118
-
Size
58KB
-
Sample
240526-ferb9afe3t
-
MD5
745db86a63082c422777fb646723ab1d
-
SHA1
41864d39e704ade8f560063b59b368c1031c3c40
-
SHA256
232f5aeb67a605446b4876aa000e202aeb2cc6bfea17d9156a1b18ccae3a4a00
-
SHA512
9a3d30179d3747e5dd1ae87378361f290c333816ca7877ae5aff03fe69cb0af8528f6fedfaa1a235b3f000c3f99cf9de8c44649126bea31605e1d5962740867a
-
SSDEEP
384:QzEIIk/7G6wXpzRprR+HpExvYzCoiCg/:34/7G6GzRprRyOvXoiCg
Behavioral task
behavioral1
Sample
745db86a63082c422777fb646723ab1d_JaffaCakes118.pps
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
745db86a63082c422777fb646723ab1d_JaffaCakes118.pps
Resource
win10v2004-20240508-en
Malware Config
Extracted
https://pastebin.com/raw/DG0EBdFy
Extracted
https://gritodopovo.com.br/RumpeTarefa.jpg
https://gritodopovo.com.br/module01.jpg
Targets
-
-
Target
745db86a63082c422777fb646723ab1d_JaffaCakes118
-
Size
58KB
-
MD5
745db86a63082c422777fb646723ab1d
-
SHA1
41864d39e704ade8f560063b59b368c1031c3c40
-
SHA256
232f5aeb67a605446b4876aa000e202aeb2cc6bfea17d9156a1b18ccae3a4a00
-
SHA512
9a3d30179d3747e5dd1ae87378361f290c333816ca7877ae5aff03fe69cb0af8528f6fedfaa1a235b3f000c3f99cf9de8c44649126bea31605e1d5962740867a
-
SSDEEP
384:QzEIIk/7G6wXpzRprR+HpExvYzCoiCg/:34/7G6GzRprRyOvXoiCg
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-