Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7c54256e6ec92c859ea6d62e0a442af8_JaffaCakes118

  • Size

    177KB

  • Sample

    240528-ke3shadg25

  • MD5

    7c54256e6ec92c859ea6d62e0a442af8

  • SHA1

    165f97f0adc9ba154007fc94f29a9241856e5d69

  • SHA256

    75f538b2ff372af6854b172dc78aea754ea64afc283c47f6c1b5bba657e9cac9

  • SHA512

    731dbbb8960ba0f6039a6d0a1529b167997fd3f2122d104419315c982037e3bb31ce1c16fa1d0ff9b350e402864a85432167d1c1d841da03ac248b3167f4cada

  • SSDEEP

    1536:GkPkfrdi1Ir77zOH98Wj2gpng9+a9/Gnut1ExbYCYWOFBfM0jKJQ2gX:grfrzOH98ipg2uiX10+JngX

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://santyago.org/wp-content/0mcYS6/

exe.dropper

http://dandyair.com/font-awesome/rOOAL/

exe.dropper

https://www.tekadbatam.com/wp-content/AUiw/

exe.dropper

http://kellymorganscience.com/wp-content/SCsWM/

exe.dropper

https://tewoerd.eu/img/DALSKE/

exe.dropper

http://mediainmedia.com/plugin_opencart2.3-master/Atye/

exe.dropper

http://nuwagi.com/old/XLGjc/

Targets

    • Target

      7c54256e6ec92c859ea6d62e0a442af8_JaffaCakes118

    • Size

      177KB

    • MD5

      7c54256e6ec92c859ea6d62e0a442af8

    • SHA1

      165f97f0adc9ba154007fc94f29a9241856e5d69

    • SHA256

      75f538b2ff372af6854b172dc78aea754ea64afc283c47f6c1b5bba657e9cac9

    • SHA512

      731dbbb8960ba0f6039a6d0a1529b167997fd3f2122d104419315c982037e3bb31ce1c16fa1d0ff9b350e402864a85432167d1c1d841da03ac248b3167f4cada

    • SSDEEP

      1536:GkPkfrdi1Ir77zOH98Wj2gpng9+a9/Gnut1ExbYCYWOFBfM0jKJQ2gX:grfrzOH98ipg2uiX10+JngX

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks