Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

5c20ceab3a...18.exe

windows7-x64

7

5c20ceab3a...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 13:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c20ceab3a5369fb0451fef3d17231b7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    5c20ceab3a5369fb0451fef3d17231b7

  • SHA1

    702e499d30b1bd5f868839b64018162559ba8747

  • SHA256

    92cb57cd42b553e07797f5375ec09fb54ac80a02a9296558aae1a8f55c232ff5

  • SHA512

    2b0d301c1ba60b2e9363d879364e16f02666fec0ac961cd0092cef8dac87ece580c49e779bcee93dfb877c638de9a5872e808a20e8ec2f250cf3e4e7ef395ed0

  • SSDEEP

    24576:xkdME3FuNCfRoIrANIMnVU0Zcibico/P4UBlAW8EeclP:xkfDRoI0NTVU0Gco/P47sf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c20ceab3a5369fb0451fef3d17231b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c20ceab3a5369fb0451fef3d17231b7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\GLBB7EA.tmp
      C:\Users\Admin\AppData\Local\Temp\GLBB7EA.tmp 4736 C:\Users\Admin\AppData\Local\Temp\5C20CE~1.EXE
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GLBB7EA.tmp
    Filesize

    70KB

    MD5

    399af268162c6035cbfddd7d78e576c4

    SHA1

    6ac4d5546f577beeca2fbc1dfee70b4531ebe428

    SHA256

    6738aa93da3afb86372bc5e97ae7c69572674fdcef7fbf2c9fcc671f79143c20

    SHA512

    d9142fe243153ca11ec1e6a72d29a200a87e27618df8588dd8dd8027bb1291e502e1c736a263a38923d9914b4ffc06bf77ed59be713598d6bc0e04f5f1815963

    Download Submit

  • \Users\Admin\AppData\Local\Temp\GLCB828.tmp
    Filesize

    161KB

    MD5

    8c97d8bb1470c6498e47b12c5a03ce39

    SHA1

    15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

    SHA256

    a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

    SHA512

    7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

    Download Submit