Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
854d06e29faceaedb3a26195d921c163_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
854d06e29faceaedb3a26195d921c163_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/evcqdwp.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/evcqdwp.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/evcqdwp.dll
-
Size
166KB
-
MD5
9f0a2b99a21e9f74ff5301683015eee5
-
SHA1
f737ccb077c227124e54736107fb120d257429ac
-
SHA256
4ddaf119fa946dd4c30d5e0a8a189fc52a2871dd930c35d09e9d2a03a0969a56
-
SHA512
ae657b93deef13b624498c4339e257c84c511b726c85275b35dddd635fd7ad884e81bc31545a7a64fe8ed615eac4ba44cd314e071b976097ce2b4488bf4f8ad8
-
SSDEEP
3072:GTh2gtEEADqaQs/SvvUhstM1dPmcNM+8q9szYTab:Yh2gWEA3AHUVdPmzaub
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1952 1728 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 2388 wrote to memory of 1728 2388 rundll32.exe 28 PID 1728 wrote to memory of 1952 1728 rundll32.exe 29 PID 1728 wrote to memory of 1952 1728 rundll32.exe 29 PID 1728 wrote to memory of 1952 1728 rundll32.exe 29 PID 1728 wrote to memory of 1952 1728 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 2203⤵
- Program crash
PID:1952
-
-