Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a93366e3225998a55645b232a6c8baa9_JaffaCakes118
-
Size
143KB
-
Sample
240819-cstsraygre
-
MD5
a93366e3225998a55645b232a6c8baa9
-
SHA1
c5364b3afcbd7b2912c758e086d788c94f84fee4
-
SHA256
3bff1d6887ad771d70ef433b5451e7b4aaa8f2ae98b84f5ddb349f40f4ece460
-
SHA512
281042a592366ab3352ee87e73e4d1bc5a96ed3413b0aab69d08a30d600c6b1bbbed7aa8b83de5af51b9dc60f24290b587bc92cb11516a2570c3d8ae4c90283b
-
SSDEEP
1536:IBpHfa3BkRD3bNqfNpu39IId5a6XP3Mg8afmqzMxXOYgnJnIJe4SGOMKaK4/D:0R1qf69xak3MgxmeY0nae4sMKT6D
Static task
static1
Behavioral task
behavioral1
Sample
a93366e3225998a55645b232a6c8baa9_JaffaCakes118.doc
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a93366e3225998a55645b232a6c8baa9_JaffaCakes118.doc
Resource
win10v2004-20240802-en
Malware Config
Extracted
http://ibccglobal.com/thankyou2/ARA/
http://work.digitalvichar.com/1mv7clu/o/
http://13.229.25.57/7xdfb/jpA/
http://binarystationary.com/cgi-bin/5rM/
http://fmcav.com/images/ZQF/
https://kodiakheating.com/ldnha/ybI/
https://khvs.vrfantasy.gallery/igiodbck/eXq/
Targets
-
-
Target
a93366e3225998a55645b232a6c8baa9_JaffaCakes118
-
Size
143KB
-
MD5
a93366e3225998a55645b232a6c8baa9
-
SHA1
c5364b3afcbd7b2912c758e086d788c94f84fee4
-
SHA256
3bff1d6887ad771d70ef433b5451e7b4aaa8f2ae98b84f5ddb349f40f4ece460
-
SHA512
281042a592366ab3352ee87e73e4d1bc5a96ed3413b0aab69d08a30d600c6b1bbbed7aa8b83de5af51b9dc60f24290b587bc92cb11516a2570c3d8ae4c90283b
-
SSDEEP
1536:IBpHfa3BkRD3bNqfNpu39IId5a6XP3Mg8afmqzMxXOYgnJnIJe4SGOMKaK4/D:0R1qf69xak3MgxmeY0nae4sMKT6D
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-