Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7d547839f4b79901becf9c6f637ae04c_JaffaCakes118
-
Size
178KB
-
Sample
240528-r2jrgahc3s
-
MD5
7d547839f4b79901becf9c6f637ae04c
-
SHA1
af5f4857e4c3ae01b88e957d3458ea93b88fe7a2
-
SHA256
2f21aa81b394e0b43e1f6a75e671ac3df68135f44ba1ed1c982a65cb2d8bee9f
-
SHA512
20233835a701a2b4631e09c93ec269200520e67d74d7d94af1a884cf1fac1c524d90a2fc735bfb9f38f29d702b4f98f14c13bdfdbf9979e6c45b41b15c174f16
-
SSDEEP
3072:u4PrXcuQuvpzm4bkiaMQgAlSmxtpiBwXH2:HDRv1m4bnQgISmxtwBwXH2
Behavioral task
behavioral1
Sample
7d547839f4b79901becf9c6f637ae04c_JaffaCakes118.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d547839f4b79901becf9c6f637ae04c_JaffaCakes118.doc
Resource
win10v2004-20240508-en
Malware Config
Extracted
http://tavo.cl/resumen-uso-inodos/2/
http://swiftlogisticseg.com/wp-admin/yV/
http://uss.ac.th/cgi-bin/g0/
http://nettube.com.br/rar/AM/
https://onyourleftracing.com/cgi-bin/uas/
http://paganwitch.com/wp-admin/H/
http://turbozero.com/luxcal/files/z/
Targets
-
-
Target
7d547839f4b79901becf9c6f637ae04c_JaffaCakes118
-
Size
178KB
-
MD5
7d547839f4b79901becf9c6f637ae04c
-
SHA1
af5f4857e4c3ae01b88e957d3458ea93b88fe7a2
-
SHA256
2f21aa81b394e0b43e1f6a75e671ac3df68135f44ba1ed1c982a65cb2d8bee9f
-
SHA512
20233835a701a2b4631e09c93ec269200520e67d74d7d94af1a884cf1fac1c524d90a2fc735bfb9f38f29d702b4f98f14c13bdfdbf9979e6c45b41b15c174f16
-
SSDEEP
3072:u4PrXcuQuvpzm4bkiaMQgAlSmxtpiBwXH2:HDRv1m4bnQgISmxtwBwXH2
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-