Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 04:08
Static task
static1
Behavioral task
behavioral1
Sample
15e8fe010b804745b96bf36971f079f3_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15e8fe010b804745b96bf36971f079f3_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/dsvfr.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/dsvfr.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/dsvfr.dll
-
Size
126KB
-
MD5
c77a97b9a08e2e742170cc1aa7c2fcb1
-
SHA1
98d637e1f3cf0fdebd74bf821aaf43bd42590a06
-
SHA256
e9f06c5e19f0682473abc1f73fd7c400dbb0d79124c161f4f863a2be7249ac72
-
SHA512
f73d8ba2dc2bb0707edbc0ba1fd9b89742fc91f787c5c58f9243dad42a2de64d655bd34068d3a92a7630810249f3fdeb389b2318a3d1482f29b5ce79e0fbc575
-
SSDEEP
1536:FNq0obaPab4FZRC7SEDfqsaOFX4nmffJx+MxADrwx7E5nEBxDJfWzxpP7pkDfur:7q0May6RC7/GmfrJ9x7EsDWzxpPNkDf
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2784 5036 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3156 wrote to memory of 5036 3156 rundll32.exe 84 PID 3156 wrote to memory of 5036 3156 rundll32.exe 84 PID 3156 wrote to memory of 5036 3156 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dsvfr.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dsvfr.dll,#12⤵PID:5036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 6003⤵
- Program crash
PID:2784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5036 -ip 50361⤵PID:380