Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7bffd14e082a46ebe938249b666cc696_JaffaCakes118

  • Size

    189KB

  • Sample

    240528-g48s9shb71

  • MD5

    7bffd14e082a46ebe938249b666cc696

  • SHA1

    374cb1075511872db3690b59d20e3d905d313fad

  • SHA256

    5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853

  • SHA512

    26dc5b478e3752d87e80bc0cbf5390d949b22de126c03f6dbc4d379dd36adc333cd4a9c94c06ebabc05620226aab5b1130c9e539d09cfa9149430077f08fbe4a

  • SSDEEP

    1536:rrdi1Ir77zOH98Wj2gpngt+a9gi37MgT7TxZk5tBRt9k6C+A:rrfrzOH98ipgVrMgT3ytHt9ZC+A

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://geisterhouse.com/cgi-bin/LAb1/

exe.dropper

http://amyemitchell.com/themes/w/

exe.dropper

http://forestanalytics.net/images/57A7/

exe.dropper

https://konican.com/cgi-bin/cWu/

exe.dropper

http://strike3productions.com/squad/3aV6xrH/

exe.dropper

http://riandutra.com/img/wOMENgh/

exe.dropper

http://justinscott.com.au/sites/rRS/

Targets

    • Target

      7bffd14e082a46ebe938249b666cc696_JaffaCakes118

    • Size

      189KB

    • MD5

      7bffd14e082a46ebe938249b666cc696

    • SHA1

      374cb1075511872db3690b59d20e3d905d313fad

    • SHA256

      5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853

    • SHA512

      26dc5b478e3752d87e80bc0cbf5390d949b22de126c03f6dbc4d379dd36adc333cd4a9c94c06ebabc05620226aab5b1130c9e539d09cfa9149430077f08fbe4a

    • SSDEEP

      1536:rrdi1Ir77zOH98Wj2gpngt+a9gi37MgT7TxZk5tBRt9k6C+A:rrfrzOH98ipgVrMgT3ytHt9ZC+A

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks