Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
movieAndTVs.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
movieAndTVs.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
uninst.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
uninst.exe
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
fa5beae80dba254fb6c21b58265f5310
-
SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079
-
SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269
-
SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538
-
SSDEEP
192:06JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTZK72dwF7dBdcQOz:06JaVh4I5rpPbTZ+BdhO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2608 2364 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 1140 wrote to memory of 2364 1140 rundll32.exe 30 PID 2364 wrote to memory of 2608 2364 rundll32.exe 31 PID 2364 wrote to memory of 2608 2364 rundll32.exe 31 PID 2364 wrote to memory of 2608 2364 rundll32.exe 31 PID 2364 wrote to memory of 2608 2364 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 2483⤵
- Program crash
PID:2608
-
-