Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7ca5843659d80f9d4fe43c67aa1df8da_JaffaCakes118

  • Size

    164KB

  • Sample

    240528-mlwzmsff7z

  • MD5

    7ca5843659d80f9d4fe43c67aa1df8da

  • SHA1

    3ca98b710d93b47ea470b843e22ec637508389ec

  • SHA256

    aee8c2cd0f5858f9d9f402974a799cfa4ba52786593ce6681014c289e75f58c8

  • SHA512

    5cb471519c62d196338ab626d86ff289482b66fc8590436bf48b68cc434738a068d08bb44cadbd029639f084ffc458147766c77d48d58dca23391de03130f7db

  • SSDEEP

    1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a99bzN+oEyNC84/4IqQhK:lrfrzOH98ipgCoETMIqoK

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://an9news.com/aokhf/XPXV7/

exe.dropper

https://www.17geci.com/vi2w6/Z5i/

exe.dropper

https://rubycityvietnam.com/wp-admin/1c0NVtp/

exe.dropper

https://lami-jo.com/wp-admin/VMeklEt/

exe.dropper

http://vayvontinchap5s.com/vayvon5s.com/YH3mx/

exe.dropper

http://jiamini.us-east-1.elasticbeanstalk.com/static/P1Vcv/

exe.dropper

http://wach8.com/cgi-bin/5JyZcRU/

Targets

    • Target

      7ca5843659d80f9d4fe43c67aa1df8da_JaffaCakes118

    • Size

      164KB

    • MD5

      7ca5843659d80f9d4fe43c67aa1df8da

    • SHA1

      3ca98b710d93b47ea470b843e22ec637508389ec

    • SHA256

      aee8c2cd0f5858f9d9f402974a799cfa4ba52786593ce6681014c289e75f58c8

    • SHA512

      5cb471519c62d196338ab626d86ff289482b66fc8590436bf48b68cc434738a068d08bb44cadbd029639f084ffc458147766c77d48d58dca23391de03130f7db

    • SSDEEP

      1536:MgjIgjhrdi1Ir77zOH98Wj2gpngx+a99bzN+oEyNC84/4IqQhK:lrfrzOH98ipgCoETMIqoK

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks