Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
854d06e29faceaedb3a26195d921c163_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
854d06e29faceaedb3a26195d921c163_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/evcqdwp.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/evcqdwp.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/evcqdwp.dll
-
Size
166KB
-
MD5
9f0a2b99a21e9f74ff5301683015eee5
-
SHA1
f737ccb077c227124e54736107fb120d257429ac
-
SHA256
4ddaf119fa946dd4c30d5e0a8a189fc52a2871dd930c35d09e9d2a03a0969a56
-
SHA512
ae657b93deef13b624498c4339e257c84c511b726c85275b35dddd635fd7ad884e81bc31545a7a64fe8ed615eac4ba44cd314e071b976097ce2b4488bf4f8ad8
-
SSDEEP
3072:GTh2gtEEADqaQs/SvvUhstM1dPmcNM+8q9szYTab:Yh2gWEA3AHUVdPmzaub
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3488 1260 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1260 1880 rundll32.exe 81 PID 1880 wrote to memory of 1260 1880 rundll32.exe 81 PID 1880 wrote to memory of 1260 1880 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#12⤵PID:1260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 6003⤵
- Program crash
PID:3488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1260 -ip 12601⤵PID:1368