Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
167c0f4885cb6d9fc13c967bfceeb939_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
167c0f4885cb6d9fc13c967bfceeb939_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$_3_.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$_3_.exe
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
14KB
-
MD5
21010df9bc37daffcc0b5ae190381d85
-
SHA1
a8ba022aafc1233894db29e40e569dfc8b280eb9
-
SHA256
0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
-
SHA512
95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
-
SSDEEP
192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3696 2936 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3120 wrote to memory of 2936 3120 rundll32.exe 83 PID 3120 wrote to memory of 2936 3120 rundll32.exe 83 PID 3120 wrote to memory of 2936 3120 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#12⤵PID:2936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 6123⤵
- Program crash
PID:3696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2936 -ip 29361⤵PID:2580