Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
30880ed8099...18.exe
windows7-x64
70880ed8099...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3WinDjView.exe
windows7-x64
3WinDjView.exe
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0880ed80993360d6f47d0b8dd33af109_JaffaCakes118.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
WinDjView.exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
WinDjView.exe
Resource
win10v2004-20240611-en
General
-
Target
$PLUGINSDIR/LangDLL.dll
-
Size
5KB
-
MD5
1775e8fe7832f0351d4024ba3478c58d
-
SHA1
3a2aafd8275f384332f6d08224d927040ce37cb4
-
SHA256
a2a159540c738c7bc4d6ce8dd203bf859078409c0021a2a60f4b0faa5352d375
-
SHA512
362cda0e1f50a8fecde1611863b1c6218962e3ec198ce3641ce50910d400ac647cdc3742888140fd6817ce6b30d83865aa0c72292bb80b1ae86cab419e0fb2b7
-
SSDEEP
48:qV9AvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptqGUaEJyof5d2:S11GED5ZTvycNSmwVsTJuft+Fd2
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 448 1756 WerFault.exe 90 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1756 5032 rundll32.exe 90 PID 5032 wrote to memory of 1756 5032 rundll32.exe 90 PID 5032 wrote to memory of 1756 5032 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#12⤵PID:1756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 6003⤵
- Program crash
PID:448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1756 -ip 17561⤵PID:440
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4012,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:81⤵PID:868