Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7d3b71bb6a1bebc033cd5a9dcc525a36_JaffaCakes118
-
Size
200KB
-
Sample
240528-retm6agd4z
-
MD5
7d3b71bb6a1bebc033cd5a9dcc525a36
-
SHA1
9791383256e0c32f49001bc11c5bb58ed826cca3
-
SHA256
05ce719d6bbe09bf2fd00e9ce8c5d8a14c173ba82dd5a361d3a34c95586fe45d
-
SHA512
f05168f0cbebc7a8356ed43c4f2014fcbbfec156ab62b04c0949a5f524c67e3f1edc22c18918f1667163c09444e292da69f7e0f315508b74d3f1589a2c6c2101
-
SSDEEP
1536:04tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a93ig7ix5EvGtaWWfjPYKwE:04tcTvjvTY140818tIP4ovp7LmGMoI
Behavioral task
behavioral1
Sample
7d3b71bb6a1bebc033cd5a9dcc525a36_JaffaCakes118.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d3b71bb6a1bebc033cd5a9dcc525a36_JaffaCakes118.doc
Resource
win10v2004-20240508-en
Malware Config
Extracted
http://veccino56.com/gjpra/4ZR/
http://girlgeekdinners.com/wp-content/Hpz/
http://marblingmagpie.com/COPYRIGHT/Ak/
http://aplicativoipok.net/wp-includes/ONW/
http://ec2-52-56-233-157.eu-west-2.compute.amazonaws.com/wp-includes/35/
https://shd7.life/mlktv/r6/
https://www.hairlineunisexsalon.com/demo/UX/
Targets
-
-
Target
7d3b71bb6a1bebc033cd5a9dcc525a36_JaffaCakes118
-
Size
200KB
-
MD5
7d3b71bb6a1bebc033cd5a9dcc525a36
-
SHA1
9791383256e0c32f49001bc11c5bb58ed826cca3
-
SHA256
05ce719d6bbe09bf2fd00e9ce8c5d8a14c173ba82dd5a361d3a34c95586fe45d
-
SHA512
f05168f0cbebc7a8356ed43c4f2014fcbbfec156ab62b04c0949a5f524c67e3f1edc22c18918f1667163c09444e292da69f7e0f315508b74d3f1589a2c6c2101
-
SSDEEP
1536:04tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a93ig7ix5EvGtaWWfjPYKwE:04tcTvjvTY140818tIP4ovp7LmGMoI
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-