Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7d547839f4b79901becf9c6f637ae04c_JaffaCakes118

  • Size

    178KB

  • Sample

    240528-r2jrgahc3s

  • MD5

    7d547839f4b79901becf9c6f637ae04c

  • SHA1

    af5f4857e4c3ae01b88e957d3458ea93b88fe7a2

  • SHA256

    2f21aa81b394e0b43e1f6a75e671ac3df68135f44ba1ed1c982a65cb2d8bee9f

  • SHA512

    20233835a701a2b4631e09c93ec269200520e67d74d7d94af1a884cf1fac1c524d90a2fc735bfb9f38f29d702b4f98f14c13bdfdbf9979e6c45b41b15c174f16

  • SSDEEP

    3072:u4PrXcuQuvpzm4bkiaMQgAlSmxtpiBwXH2:HDRv1m4bnQgISmxtwBwXH2

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://tavo.cl/resumen-uso-inodos/2/

exe.dropper

http://swiftlogisticseg.com/wp-admin/yV/

exe.dropper

http://uss.ac.th/cgi-bin/g0/

exe.dropper

http://nettube.com.br/rar/AM/

exe.dropper

https://onyourleftracing.com/cgi-bin/uas/

exe.dropper

http://paganwitch.com/wp-admin/H/

exe.dropper

http://turbozero.com/luxcal/files/z/

Targets

    • Target

      7d547839f4b79901becf9c6f637ae04c_JaffaCakes118

    • Size

      178KB

    • MD5

      7d547839f4b79901becf9c6f637ae04c

    • SHA1

      af5f4857e4c3ae01b88e957d3458ea93b88fe7a2

    • SHA256

      2f21aa81b394e0b43e1f6a75e671ac3df68135f44ba1ed1c982a65cb2d8bee9f

    • SHA512

      20233835a701a2b4631e09c93ec269200520e67d74d7d94af1a884cf1fac1c524d90a2fc735bfb9f38f29d702b4f98f14c13bdfdbf9979e6c45b41b15c174f16

    • SSDEEP

      3072:u4PrXcuQuvpzm4bkiaMQgAlSmxtpiBwXH2:HDRv1m4bnQgISmxtwBwXH2

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks