Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7be3edfe4ad49665c39db0af0e561578_JaffaCakes118

  • Size

    179KB

  • Sample

    240528-gddkfahd63

  • MD5

    7be3edfe4ad49665c39db0af0e561578

  • SHA1

    e45a4f2d02313e6992cd56dfcce80953703d9a80

  • SHA256

    37adedb2ef245a78142b80b0da888715d3abb817111e00ae9f6c2976a79136f4

  • SHA512

    b9030077ace0d43c8429c21566910192b38808bb668f5208d34038008cce882af311d10ae31e9b83af50b619480025e7bdda2eb8da8b6e2ddad2509bc564da96

  • SSDEEP

    1536:uasrbYasrb2rdi1Ir77zOH98Wj2gpng9+a9kSGIRK9b/WYjd2LO6h/QC27TWvo:crfrzOH98ipgMSGYK9TngLOm27TWvo

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://sasystemsuk.com/index_files/j9b/

exe.dropper

https://case.gonukkad.com/sys-cache/fmC/

exe.dropper

http://vandamebuilders.com/wp-includes/OEyjc9x/

exe.dropper

https://nilinkeji.com/online/Dmz/

exe.dropper

http://paganwitch.com/wp-admin/CmubpSk/

exe.dropper

http://www.ekramco.ir/english/fn/

exe.dropper

http://votesteve.us/closed_zone/Bk/

Targets

    • Target

      7be3edfe4ad49665c39db0af0e561578_JaffaCakes118

    • Size

      179KB

    • MD5

      7be3edfe4ad49665c39db0af0e561578

    • SHA1

      e45a4f2d02313e6992cd56dfcce80953703d9a80

    • SHA256

      37adedb2ef245a78142b80b0da888715d3abb817111e00ae9f6c2976a79136f4

    • SHA512

      b9030077ace0d43c8429c21566910192b38808bb668f5208d34038008cce882af311d10ae31e9b83af50b619480025e7bdda2eb8da8b6e2ddad2509bc564da96

    • SSDEEP

      1536:uasrbYasrb2rdi1Ir77zOH98Wj2gpng9+a9kSGIRK9b/WYjd2LO6h/QC27TWvo:crfrzOH98ipgMSGYK9TngLOm27TWvo

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks