Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

20b4cf28d5...18.exe

windows7-x64

7

20b4cf28d5...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2024, 11:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    20b4cf28d5c333c398b064b9ad807469

  • SHA1

    47c14e2c7dd597da2be20b3a413be361999e92e5

  • SHA256

    22700204d42498f774aa3bfdbb65981789903938f18b2e749ae4881d0d9fc42b

  • SHA512

    68e973ba2a9e03a186faae6bc62974dff8f394d444c096039b3b1ce5a141fc1a04372bf3a3f634a077e26ef2105f2bbc7b45775ea31811bef236399253278069

  • SSDEEP

    24576:N2oo60HPdt+1CRiY2eOBvcj3u10dovsJU7P4AnPaGHtk+rz7T+MvE2ktJOlJlR/I:Qoa1taC070doNQAPPN13+Ojly

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Users\Admin\AppData\Local\Temp\19F6.tmp
      "C:\Users\Admin\AppData\Local\Temp\19F6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\20b4cf28d5c333c398b064b9ad807469_JaffaCakes118.exe D763934629A3A337621B6D2C659A4033E14250980106D29D8C8914B0A51EBE8DC378372E0A98DB061E961E56C4612E6A7CFC283597F2A796AB9A9EBD20483F71
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\19F6.tmp
    Filesize

    1.9MB

    MD5

    a9f8cb3f3beecf8bd03e468fdacdd3b7

    SHA1

    034710d81496a17bdcf2c03a7c79b8832639db9c

    SHA256

    385f673b8ac1c0dea23b8fb0f47805393c461ac41747229013535af6718c5f11

    SHA512

    146f7bd47bbb87ed9b5ce739a9164b51884681643ad132be0f055a6989f62f54dabec4f76f88c1329dacefdcbc36a3ac29843594039496bb344234678b804814

    Download Submit

  • memory/2872-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2944-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download