Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
32d94069398...18.exe
windows7-x64
72d94069398...18.exe
windows10-2004-x64
7$0/scanquery.dll
windows7-x64
1$0/scanquery.dll
windows10-2004-x64
1$0/scanquery.exe
windows7-x64
3$0/scanquery.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d94069398144fddc58ae08242b94d0a_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$0/scanquery.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$0/scanquery.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$0/scanquery.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$0/scanquery.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
326bab29f247b0d0b8438334af19d2a9
-
SHA1
df0411d0ed56443af8015d2ffe54af67d627cb9a
-
SHA256
f17b04164f332b6fefe9cf8280657940d45acd5f822816752b74ab0ce740f5cd
-
SHA512
e357e9dea57e906b09b1c9fd8d50dd379ac065fd7c6c54be4f493cf7783269ab2e01630a8a82d914b8f131a747efc9684b9f26280d725d5520f6558dca4efdac
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJ/cfUcpuQMF2Ir1A2/D7:8kjAJ4dDGkJ+AI0aAkQ+2IrR/H
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2132 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 2800 uninstall.exe 2132 Au_.exe 2132 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral7/files/0x002b000000018f8c-2.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2132 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2132 2800 uninstall.exe 30 PID 2800 wrote to memory of 2132 2800 uninstall.exe 30 PID 2800 wrote to memory of 2132 2800 uninstall.exe 30 PID 2800 wrote to memory of 2132 2800 uninstall.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691B
MD592b523099463f29bf77936087afc0814
SHA1180b9cf81cae126bd5de532a99bb024f9ae258a2
SHA256d80b566de203b21ce0c3c4817b13a1b856d1bdce56e7008e4a36f24daf509cef
SHA512cc737e54a25f55cee227c4c40edb2f6e2e7c30199b910719690df49ba0f69f721e06dacb65be82d87d3ae43063e12a55ea346cf664f462f4c2f8e1e1f4c4d305
-
Filesize
730B
MD5df454eb5667b212e0db1597dd59e469e
SHA1c203662886d6edcd379bb4b18b3e3ace74b06858
SHA256e1c590e2468288cbe624d6ded15946556052892c276493a523e55a8dfd734d32
SHA512b7816213a5aacae5b80d09ec8a5d920968605ef848cac372580b1630a73613d0637dc6bf0df045313e9fb24c7268daa5e4f5b869fb73f9ab6ea9d42d3f94ed5b
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
78KB
MD5326bab29f247b0d0b8438334af19d2a9
SHA1df0411d0ed56443af8015d2ffe54af67d627cb9a
SHA256f17b04164f332b6fefe9cf8280657940d45acd5f822816752b74ab0ce740f5cd
SHA512e357e9dea57e906b09b1c9fd8d50dd379ac065fd7c6c54be4f493cf7783269ab2e01630a8a82d914b8f131a747efc9684b9f26280d725d5520f6558dca4efdac