Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8da7c83a361c64cfa79e3d6614bae6f6_JaffaCakes118
-
Size
199KB
-
Sample
240602-lrszhaac95
-
MD5
8da7c83a361c64cfa79e3d6614bae6f6
-
SHA1
71ee435debea08d26e28406593e3622698361962
-
SHA256
895d3180e6cd0f21d0b56b5061eb6a16f029d010fc833dd6fc2b85ebbbd6b76b
-
SHA512
3558145f7e539d1293d2d3a9eae0d9a9d468488ad59986afe04c9849ad579fd88473b16a051e8c9c2a568c540e0b7c299b204b9423eea44e1b4a9cb3a1d89d75
-
SSDEEP
1536:PGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilpfsdKY7xST/Ephkop8cEpTWj14:xrfrzOH98ipgvEDvxBY5a
Behavioral task
behavioral1
Sample
8da7c83a361c64cfa79e3d6614bae6f6_JaffaCakes118.doc
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8da7c83a361c64cfa79e3d6614bae6f6_JaffaCakes118.doc
Resource
win10v2004-20240508-en
Malware Config
Extracted
https://houtai.xiaopbk.com/install/t0H/
https://gudangalami.com/ivo6rp/UaBj2/
https://webhostingsrilanka.info/pkrgs/ODn/
http://luzzeri.com/wp-includes/T1mrkC/
http://mobithem.com/blogs/Z3/
http://planosdesaudesemcarencia.com/erros/E8iv/
http://lookuppopup.co.uk/content/uploads/XNEm9/
Targets
-
-
Target
8da7c83a361c64cfa79e3d6614bae6f6_JaffaCakes118
-
Size
199KB
-
MD5
8da7c83a361c64cfa79e3d6614bae6f6
-
SHA1
71ee435debea08d26e28406593e3622698361962
-
SHA256
895d3180e6cd0f21d0b56b5061eb6a16f029d010fc833dd6fc2b85ebbbd6b76b
-
SHA512
3558145f7e539d1293d2d3a9eae0d9a9d468488ad59986afe04c9849ad579fd88473b16a051e8c9c2a568c540e0b7c299b204b9423eea44e1b4a9cb3a1d89d75
-
SSDEEP
1536:PGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilpfsdKY7xST/Ephkop8cEpTWj14:xrfrzOH98ipgvEDvxBY5a
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-