Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
3015ef1995c2373f56cbdb28df5cd7a2_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3015ef1995c2373f56cbdb28df5cd7a2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/sylrhaz.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/sylrhaz.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/sylrhaz.dll
-
Size
161KB
-
MD5
8bc4405aab9e9e2e8e17aceb0a273772
-
SHA1
533762514c6d40e79a5cd604f310fd5f7151070c
-
SHA256
2b47725c2c625bb22e96229572b8fdfd3b87fe8642a98a13b80f9fd10da6bdb5
-
SHA512
238b45df7df079112fd38771e9fb391236c7a5b96756123d6b66c4964f0a9d639227cecbef6812f6cd22a9415bc72219aa8b6926ab06451da497b1ff4cc84878
-
SSDEEP
1536:GDlDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcowsc:GDTZS4QOBK88CvGLKEIz+QVdQY0ZccH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3672 1400 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1400 1968 rundll32.exe 81 PID 1968 wrote to memory of 1400 1968 rundll32.exe 81 PID 1968 wrote to memory of 1400 1968 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#12⤵PID:1400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 6003⤵
- Program crash
PID:3672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1400 -ip 14001⤵PID:4808