Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7d35b69ae614653d569535baf265f91f_JaffaCakes118

  • Size

    241KB

  • Sample

    240528-q9vchagb8w

  • MD5

    7d35b69ae614653d569535baf265f91f

  • SHA1

    50f85770714d8c5b4fc4cec3bed743aac14363e2

  • SHA256

    ac42afa0ef48f495f2bf550b9b0211afc2d26f018203cb00f12d9069e76f9db3

  • SHA512

    75126958819a163b064f5684c33ed2631c4a4ab96031f66a6fa1596fcada07d5f02dcbad29c0d36d19bc822ac5be34f3106a53e202c9633ab0e48c59a0b959a2

  • SSDEEP

    3072:wYy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////o:40uXnWFchmmcI/o1/wOfX7

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.ksgresearch.org/LLC/z9B/

exe.dropper

http://www.mitrausahacontrucion.com/multifunctional-section/X2v4XN/

exe.dropper

http://daprofesional.com/data4/rsdbA1h/

exe.dropper

http://degisimkalip.com.tr/wp-admin/ZML/

exe.dropper

http://da-industrial.com/js/6GGA48AK/

exe.dropper

http://cse-engineer.com/cgi-bin/BOiL/

exe.dropper

http://casabeethovenlb.com/classes/7SUlG/

Targets

    • Target

      7d35b69ae614653d569535baf265f91f_JaffaCakes118

    • Size

      241KB

    • MD5

      7d35b69ae614653d569535baf265f91f

    • SHA1

      50f85770714d8c5b4fc4cec3bed743aac14363e2

    • SHA256

      ac42afa0ef48f495f2bf550b9b0211afc2d26f018203cb00f12d9069e76f9db3

    • SHA512

      75126958819a163b064f5684c33ed2631c4a4ab96031f66a6fa1596fcada07d5f02dcbad29c0d36d19bc822ac5be34f3106a53e202c9633ab0e48c59a0b959a2

    • SSDEEP

      3072:wYy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////o:40uXnWFchmmcI/o1/wOfX7

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks