Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9e972ab3de4df68d97295fa72d98960c_JaffaCakes118

  • Size

    202KB

  • Sample

    240611-sfbpea1hkj

  • MD5

    9e972ab3de4df68d97295fa72d98960c

  • SHA1

    0010567186c9c8d6f88f10577ddd8008b97a1fb9

  • SHA256

    b8df8ad18c3d755eb12ee45b59cf06643c3edcf77b47e869780b3be3cb1ab4b5

  • SHA512

    18e1d438e87dc823198a568c16781fec0f25743e1b731c1cf374185ec2ddeca2b8be89b43ece16f5435c3ec94e01487141be1cbe39a5f7606eb1b1bcefcd505b

  • SSDEEP

    1536:44tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a94IfxO5dq78ct2PU7MXKSw:44tcTvjvTY140818tIP4ovpoGqfXJL

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://veccino56.com/gjpra/4ZR/

exe.dropper

http://girlgeekdinners.com/wp-content/Hpz/

exe.dropper

http://marblingmagpie.com/COPYRIGHT/Ak/

exe.dropper

http://aplicativoipok.net/wp-includes/ONW/

exe.dropper

http://ec2-52-56-233-157.eu-west-2.compute.amazonaws.com/wp-includes/35/

exe.dropper

https://shd7.life/mlktv/r6/

exe.dropper

https://www.hairlineunisexsalon.com/demo/UX/

Targets

    • Target

      9e972ab3de4df68d97295fa72d98960c_JaffaCakes118

    • Size

      202KB

    • MD5

      9e972ab3de4df68d97295fa72d98960c

    • SHA1

      0010567186c9c8d6f88f10577ddd8008b97a1fb9

    • SHA256

      b8df8ad18c3d755eb12ee45b59cf06643c3edcf77b47e869780b3be3cb1ab4b5

    • SHA512

      18e1d438e87dc823198a568c16781fec0f25743e1b731c1cf374185ec2ddeca2b8be89b43ece16f5435c3ec94e01487141be1cbe39a5f7606eb1b1bcefcd505b

    • SSDEEP

      1536:44tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a94IfxO5dq78ct2PU7MXKSw:44tcTvjvTY140818tIP4ovpoGqfXJL

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks