Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
30d9d5b89be...18.exe
windows7-x64
70d9d5b89be...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3cjzg.exe
windows7-x64
1cjzg.exe
windows10-2004-x64
1config.dll
windows7-x64
5config.dll
windows10-2004-x64
5iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
0d9d5b89be5ce0828462eb8567e1730f_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
0d9d5b89be5ce0828462eb8567e1730f_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
cjzg.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
cjzg.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
config.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
config.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
iconAnimate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
iconAnimate.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
iconTips.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
iconTips.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
iconAnimate.exe
-
Size
426KB
-
MD5
9b61f1470bada3072365f8647292728e
-
SHA1
2caa1ff4eb40403c2bb1c1c3b8b531184ecd8b07
-
SHA256
337398c9699c53a11bd422a035371cbb8a596315895ea23b0e2494c7b6434c4a
-
SHA512
cf40e794c5be1792a0fc63e9cc971bd52bdace6252fba3002ca49f13c7936f92fa6615fb034a320a626f0dbfe002816eda9c8eeb3d0057935f18856ff1f16d90
-
SSDEEP
6144:ulYIXLG7MovlVaukmKiuwv11rf1Ar3Q2HR5mV1TiyuqnODoRPD:upi7Mo92iuwNV1Apx5OTiOOD6D
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4328 iconAnimate.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56 PID 4328 wrote to memory of 3412 4328 iconAnimate.exe 56