Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c57658ef781e0f31e6539263bb87c7fc_JaffaCakes118
-
Size
555KB
-
Sample
240827-wq58jsvhqr
-
MD5
c57658ef781e0f31e6539263bb87c7fc
-
SHA1
4a8902bdbfe4d490aac56b9962caec5598e5604c
-
SHA256
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
SHA512
637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
-
SSDEEP
12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F
Static task
static1
Behavioral task
behavioral1
Sample
c57658ef781e0f31e6539263bb87c7fc_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
formbook
4.1
bft
edenicities.com
buntingfordhomeservices.com
nuanceproducoes.com
divasinspire.com
capiturn.com
zbjsn.com
thegioicaytrongnha.com
featherventure.com
onbrandtrading.com
sanguoban.com
doorman.pro
ourhomie.net
iwassickonholiday.com
mrcskin.com
reallycoolmask.com
tkrbeautyinstitut.com
keytomiami.com
sesliduybeni.com
asherwebber.com
starkweatherwindows.net
btcdqr.com
bodvlog.com
justice-facile.com
mysuccessmatters.com
devperformancesystems.com
desk-tech.com
uyhams.com
awakenwithrochelle.com
brpodiatrist2.com
sparklycleanhome.com
huiduog.com
rxb.xyz
thfarm.info
champagneveuveclicquot.wine
carolinaboterocorrea.com
cqwodeer.com
sportsplanetenterprises.com
cindyarguello.com
txcxxx.com
bullishonpennies.com
danddprecision.com
quietflyte.com
fastworldbd.com
savingz1.info
bluecapitalci.com
youridolz.com
andredeklerk.com
hawatt.com
tryangel.store
memorastudio.com
damiansaint.net
kozipets.com
mmafightsport.com
alboran4.com
ensignmusic.com
southerneatzatl.com
contrarrie.com
pastissadebeach.com
desingjad.com
glupemajice.com
kantoi.net
rambaudmail.com
gokaka.com
marcoded.com
brasilseo.com
Targets
-
-
Target
c57658ef781e0f31e6539263bb87c7fc_JaffaCakes118
-
Size
555KB
-
MD5
c57658ef781e0f31e6539263bb87c7fc
-
SHA1
4a8902bdbfe4d490aac56b9962caec5598e5604c
-
SHA256
a45cec5c48aae2040669ece459ae34de87251080934add3da91e9ab72ea2abe7
-
SHA512
637f1ef12dc4e3d86f8d5dec18c1cbe88c08db1a150de090e9f1135643136e0abd73f75b0b1c14c6cd144280b736cb25cbe28be13747ccc01e5420fed4a56922
-
SSDEEP
12288:B3tTTCkyO2KnJVr7tjoH5QPpCuzYGWrrUN8ywGIgyfOZadEVFMWM:B9b1r785e1zW8N8ywLfK7F
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-