Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
3ea5f2026f29ad304deb032306e375d5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ea5f2026f29ad304deb032306e375d5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
rsqzbmeb.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
rsqzbmeb.dll
Resource
win10v2004-20240709-en
General
-
Target
rsqzbmeb.dll
-
Size
17KB
-
MD5
897c832f3eb442e7f96c20ae05b4de70
-
SHA1
31b2460d73f6aff9a4c0c3870bc7f9249ccfcd5f
-
SHA256
eb2571fb4662c94ccc62555f342e8ceb726dede6353e2c3991c2c23acaa8d00b
-
SHA512
084c4cbcbb8cbcef77c134c7c664905ba0325bf03d90f8a5b8552f6e0ffa3923c98a1e3477541cfef5e325676926f8191ffaaa83e1ad44ee0701462cb2b829fc
-
SSDEEP
384:nyUREpuZ9noZ4oiG/gFdmVrRcnFTMc/fja+JnGb+ibc:nywCu9nSZcFoDcnFdGYGbv
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30 PID 3056 wrote to memory of 3068 3056 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rsqzbmeb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rsqzbmeb.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-