Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
33747b8d5a1...18.exe
windows7-x64
73747b8d5a1...18.exe
windows10-2004-x64
7$PLUGINSDI...if.dll
windows7-x64
3$PLUGINSDI...if.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$R1/$SYSDI...er.dll
windows7-x64
1$R1/$SYSDI...er.dll
windows10-2004-x64
1$R1/npuuseep.dll
windows7-x64
1$R1/npuuseep.dll
windows10-2004-x64
3$SYSDIR/gt...ed.dll
windows7-x64
1$SYSDIR/gt...ed.dll
windows10-2004-x64
1$TEMP/Baidu-ASBar.exe
windows7-x64
1$TEMP/Baidu-ASBar.exe
windows10-2004-x64
3$PROGRAM_F...ar.dll
windows7-x64
7$PROGRAM_F...ar.dll
windows10-2004-x64
7$TEMP/Goog...ed.exe
windows7-x64
1$TEMP/Goog...ed.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3747b8d5a17dd899b49d9db215062252_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$R1/$SYSDIR/nsis_loader.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$R1/$SYSDIR/nsis_loader.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$R1/npuuseep.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$R1/npuuseep.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$SYSDIR/gtapi_signed.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$SYSDIR/gtapi_signed.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$TEMP/Baidu-ASBar.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$TEMP/Baidu-ASBar.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
$PROGRAM_FILES/Baidu/AddressBar/AddressBar_Tmp/AddressBar.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
$PROGRAM_FILES/Baidu/AddressBar/AddressBar_Tmp/AddressBar.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
$TEMP/GoogleToolbarInstaller_download_signed.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
$TEMP/GoogleToolbarInstaller_download_signed.exe
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/AnimGif.dll
-
Size
9KB
-
MD5
11e94fedb34f46458f9dc773a91f2770
-
SHA1
791cf30880c74df9d6f7c1e637e4fdf5fa88b38a
-
SHA256
54ccdcb42fb3e63b7a55e8c0e7d12182a0338ea38b106b793ca048000a189ab5
-
SHA512
57dd38bebdd7d8fbc4b3daeecabc5c2617d4f5b2f6ad2396a702f1da362bc72deacfea2dd1550b0e00269188676324e1b7dd6ed372211c8bf664af824ac8d950
-
SSDEEP
96:kVh/i//UrWWXMAb+6aNqRjTwUWo5zFyRH0aTyZekTIVCAEHZNKNy0p:uh/Bl8AIQR/bWSMRH00yQBEH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1852 5012 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3524 wrote to memory of 5012 3524 rundll32.exe 84 PID 3524 wrote to memory of 5012 3524 rundll32.exe 84 PID 3524 wrote to memory of 5012 3524 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimGif.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimGif.dll,#12⤵PID:5012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 6003⤵
- Program crash
PID:1852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 50121⤵PID:2528