Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ab5d439876f093f5fd7a4f2b015b4be_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
movieAndTVs.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
movieAndTVs.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
uninst.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
uninst.exe
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
fa5beae80dba254fb6c21b58265f5310
-
SHA1
f2f776611dbbb157b151aa744a7e0be1d4b8c079
-
SHA256
34b8a2130729064ca2f9b3b8e6f90d883d84662156b648a4eeccefefc3473269
-
SHA512
7c74b9e9f1ff0665ffd6fcf76fca462d9f4fbd7c4a215bc67b419497ef4c3cb9cede6c5b0803cabb316bc5391c4c6f0d578d36e1094b8ed326b140f8e272b538
-
SSDEEP
192:06JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTZK72dwF7dBdcQOz:06JaVh4I5rpPbTZ+BdhO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 448 3096 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4776 wrote to memory of 3096 4776 rundll32.exe 84 PID 4776 wrote to memory of 3096 4776 rundll32.exe 84 PID 4776 wrote to memory of 3096 4776 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 6363⤵
- Program crash
PID:448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3096 -ip 30961⤵PID:216