Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
jpwbCJK80/jpwbCJK.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
jpwbCJK80/jpwbCJK.exe
Resource
win10v2004-20240508-en
General
-
Target
jpwbCJK80/jpwbCJK.exe
-
Size
2.7MB
-
MD5
df59ed3f4eabc974d8a1d6880cff633b
-
SHA1
32b03cafbef31fbb04a90ce74d00548a3a4d9976
-
SHA256
a942353b36657d97abde65dac764616316c10db5cec38361bc3d0f4423753875
-
SHA512
f356bd0f7e30598449b10da0ae517413547f6e026db9604968ee190a61990ba5ffcef85c4bea8598ac1f062c19f39ed9ea91f0d2df71a92745396f4e752660fe
-
SSDEEP
49152:Hl0RNTWUM52OErI3NuI29ikf1IPh5Xlw/NjndSse/eDO8DyzzG3oBGHUhaEl0rjl:HlmNTE52OEE3NuT9hf1IPh5X6lb3FDO2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1800 jpwbCJK.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 216 wrote to memory of 1800 216 jpwbCJK.exe 83 PID 216 wrote to memory of 1800 216 jpwbCJK.exe 83 PID 216 wrote to memory of 1800 216 jpwbCJK.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe"C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\is-Q3RVK.tmp\jpwbCJK.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q3RVK.tmp\jpwbCJK.tmp" /SL5="$600EC,2463180,57856,C:\Users\Admin\AppData\Local\Temp\jpwbCJK80\jpwbCJK.exe"2⤵
- Executes dropped EXE
PID:1800
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
703KB
MD5208896db5485a092cb2364608f76b1e2
SHA1772e070dae033efe0b97c0361106154e954f929c
SHA256cf1c153b12899772966fcb22e4f25d32ee3685a29b85f1b82a4eb135f88a91cb
SHA512753c7808a3c10b651c60257a34698a62f8d93f072b3a2e2a137e0e10013f9d98ce32bfcb98d8cd73c37a8aeb1a110130a8e6b718693cc47be4f7ec7fe61fc56e