Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
0f98374016e2f3a77034ecf068624e89_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0f98374016e2f3a77034ecf068624e89_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/GameuxInstallHelper.dll
-
Size
94KB
-
MD5
4d3ac88054df63fc810427bdaa96c458
-
SHA1
e4d554e03ba91f6b53a2a80253b339f56e303c94
-
SHA256
b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6
-
SHA512
d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54
-
SSDEEP
1536:B+cZE7LuH82vbVSEru0QrtLMNYxKoqbEnz8Gj1Nh5vIexy8Cy/3:YcE7LV2ULMZowGjJ5vIexy8Cy/3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3812 wrote to memory of 2400 3812 rundll32.exe 82 PID 3812 wrote to memory of 2400 3812 rundll32.exe 82 PID 3812 wrote to memory of 2400 3812 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GameuxInstallHelper.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GameuxInstallHelper.dll,#12⤵PID:2400
-