Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 02:20
Static task
static1
Behavioral task
behavioral1
Sample
22c8e381a2694112261841028945a4b3_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
22c8e381a2694112261841028945a4b3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/system.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/system.dll
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/system.dll
-
Size
1.9MB
-
MD5
e39726530c308f80f100b60c690d5628
-
SHA1
a9ae282081ffaaac29a33f4ee24d2e3f1200c102
-
SHA256
a60bf8267f8caa62776141a16da7cefdcb767dd2f7ce15587bb5af7170f053f5
-
SHA512
4d22e48903024075c064a78dfc1c5f0ac76c6a61e32e1e22f07ea6d1b51cae7d84c9c7e72c88d57fe8d883995d9eff1eb5c41c9bfa7feac638f5c5df43228cc4
-
SSDEEP
49152:KQ5KUpZoYl43ExebD8qgxhHfKjFWRzGm09mI5wuNfpo5kVPCN6w8Txp/0QH4bpoa:pKJYl4Mefgxh/wFWRzGm09mI5wuNfpoM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4580 232 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4308 wrote to memory of 232 4308 rundll32.exe 84 PID 4308 wrote to memory of 232 4308 rundll32.exe 84 PID 4308 wrote to memory of 232 4308 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\system.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\system.dll,#12⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 6483⤵
- Program crash
PID:4580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 232 -ip 2321⤵PID:208