Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a97f874d6313ccfefceec77c2ccf1fda_JaffaCakes118
-
Size
814KB
-
Sample
240614-nv5htashnj
-
MD5
a97f874d6313ccfefceec77c2ccf1fda
-
SHA1
0b140d33ec06f7387ad3763e30c091b255d4115e
-
SHA256
b5abd46caecf027f71d1dc3c78d490092a82d70dea355cf83523a70b6967be6e
-
SHA512
fd8e26830e6a511ae8b16cd6798cde208bf0584ba4f89fd2321b6a47ccde401860bbec1485904dea0feae42349b553744711d4e5d3bf3b4631bb9119b1b69110
-
SSDEEP
12288:e+WhWEyIueil9U4zx+InkxPn6L7KHPpwsXafAJJDBuoMY3l9Uae:eIRIWl9U4zUNP6HnqafAv1n3l9UB
Static task
static1
Behavioral task
behavioral1
Sample
a97f874d6313ccfefceec77c2ccf1fda_JaffaCakes118.rtf
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a97f874d6313ccfefceec77c2ccf1fda_JaffaCakes118.rtf
Resource
win10v2004-20240611-en
Malware Config
Extracted
formbook
3.8
ch35
sitepm.site
chancein.net
urbanairer.com
jxzr888.com
maynewyork.com
snowcamel.net
montqranite.com
beijingplanettrading.com
private-placement-program.com
cureguru.com
elementorlandosouthwest.com
ohdoll.com
sunsationalpools.net
bionic.claims
0pe485.com
cc1231.com
waterdamagesoluton.online
melionp.reisen
bioepidemic.foundation
iprofi.online
yuanfenniao.com
zinkism.com
readytraffic4upgrades.date
mycommonentrance.com
niptonofweed.com
saferhealthalternatives.com
uzhackteam.com
crystaldantel.com
10o4.com
dreamliketech.com
oregonhempmarket.com
soliloquygame.com
overyondertx.com
ontrackcontact.com
krownrecords.com
vozdocalvario.com
71oi.info
sccy555.com
kuudii.com
leaveyourboat.com
klusjesman.online
happilyeverjohnstone.com
portnov.photography
eyesoftexasdroneservices.com
re-design.online
stvdale.com
divorcelawyerno.com
xn--9kq121kjqq.com
81manbetx.com
heidistreasuretrove.com
malenyvideo.com
auth-2fa.com
dhqwtsns.com
nano-shielding.com
daixieshangyejihuashu.com
bolchoyremont-92.com
dahuowen.com
pepemaxonline.com
sonyerin.com
tkmamba.com
goodplace.world
tanveerisnotcool.com
lgktwh.com
eryugi.info
empoweremyv.com
Targets
-
-
Target
a97f874d6313ccfefceec77c2ccf1fda_JaffaCakes118
-
Size
814KB
-
MD5
a97f874d6313ccfefceec77c2ccf1fda
-
SHA1
0b140d33ec06f7387ad3763e30c091b255d4115e
-
SHA256
b5abd46caecf027f71d1dc3c78d490092a82d70dea355cf83523a70b6967be6e
-
SHA512
fd8e26830e6a511ae8b16cd6798cde208bf0584ba4f89fd2321b6a47ccde401860bbec1485904dea0feae42349b553744711d4e5d3bf3b4631bb9119b1b69110
-
SSDEEP
12288:e+WhWEyIueil9U4zx+InkxPn6L7KHPpwsXafAJJDBuoMY3l9Uae:eIRIWl9U4zUNP6HnqafAv1n3l9UB
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Formbook payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-