Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
31e5572dcda...18.exe
windows7-x64
31e5572dcda...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...ly.dll
windows7-x64
3$PLUGINSDI...ly.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
92s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 09:20
Static task
static1
Behavioral task
behavioral1
Sample
1e5572dcda5244cd7451da31e92cdb4d_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1e5572dcda5244cd7451da31e92cdb4d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISPlugin.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISPlugin.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISPlugin_JApply.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISPlugin_JApply.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
General
-
Target
$PLUGINSDIR/NSISPlugin.dll
-
Size
1.0MB
-
MD5
362eddf4162293770bcff8fa9bfabb7f
-
SHA1
aa80ab76aac054e6c3ebb2487ce396f92e97dc21
-
SHA256
f2b73ba3ca42dd9097727f6e0aabfa63b566c2d78be0d41791d72c6d16240d78
-
SHA512
cbf4ba93afb6a9d6ac0a6a1cfef473d163b59e7737bb644e358ec6107a4730bd0cadfba6b8baeb2a597a8af90d5c861f6441b3d4f78873a06a82872af14a2e36
-
SSDEEP
24576:Ix8E92oL6HJRtUj9xcSI338TzMQyK/O0:8H28BPYcTAQyKX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4480 3060 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1248 wrote to memory of 3060 1248 rundll32.exe 87 PID 1248 wrote to memory of 3060 1248 rundll32.exe 87 PID 1248 wrote to memory of 3060 1248 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISPlugin.dll,#12⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6483⤵
- Program crash
PID:4480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3060 -ip 30601⤵PID:4224