Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
70bb8eb516b...18.exe
windows7-x64
70bb8eb516b...18.exe
windows10-2004-x64
7$PLUGINSDIR/DL.dll
windows7-x64
1$PLUGINSDIR/DL.dll
windows10-2004-x64
1$PLUGINSDIR/IS.dll
windows7-x64
3$PLUGINSDIR/IS.dll
windows10-2004-x64
3$PLUGINSDIR/NET.dll
windows7-x64
1$PLUGINSDIR/NET.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ON.dll
windows7-x64
7$PLUGINSDI...ON.dll
windows10-2004-x64
7$PLUGINSDI...ze.dll
windows7-x64
7$PLUGINSDI...ze.dll
windows10-2004-x64
7Analysis
-
max time kernel
55s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 11:50
Behavioral task
behavioral1
Sample
0bb8eb516bce14354d8e0884feb299d3_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0bb8eb516bce14354d8e0884feb299d3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DL.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/IS.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/IS.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NET.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NET.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsResize.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsResize.dll
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/NET.dll
-
Size
92KB
-
MD5
63834ec07c42859db4ebef4947046d50
-
SHA1
ea9551cba09926ae639c0ba93479049fc060af4c
-
SHA256
1bd3438268e3a8e6060ec607e503714805657d01b3a35fea289f2624ff3265c0
-
SHA512
972b8ecfa0ba2bae2f7ed269f66a11a90dfc45435f916bfee58ce493fb244b0b077412260390cf43adf64098f2771daabdd3541e2350137f450423d8c119503e
-
SSDEEP
1536:8GW1TSWGZGWPtCVR/sdd8smDk+A6cvFsWjcd9sEcrteEV6:8GISpZti6dT+AXq9grteEV6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1268 3500 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3500 4900 rundll32.exe 83 PID 4900 wrote to memory of 3500 4900 rundll32.exe 83 PID 4900 wrote to memory of 3500 4900 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NET.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NET.dll,#12⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 6203⤵
- Program crash
PID:1268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3500 -ip 35001⤵PID:1916