Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
36464a2beef...18.exe
windows7-x64
36464a2beef...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3acid.chm
windows7-x64
1acid.chm
windows10-2004-x64
1acid.exe
windows7-x64
1acid.exe
windows10-2004-x64
1ttsacid.dll
windows7-x64
1ttsacid.dll
windows10-2004-x64
1ttsacid4.dll
windows7-x64
1ttsacid4.dll
windows10-2004-x64
1ttseng5.exe
windows7-x64
ttseng5.exe
windows10-2004-x64
Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
6464a2beefe6f1670ad213f8c34d5105_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6464a2beefe6f1670ad213f8c34d5105_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
acid.chm
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
acid.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
acid.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
acid.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
ttsacid.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
ttsacid.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
ttsacid4.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
ttsacid4.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
ttseng5.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
ttseng5.exe
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
06bef96b91bfa75b7f7817341a6cd597
-
SHA1
48a40368fc339ccea1dfda06d2e02bca7d7265c1
-
SHA256
2ca5590c85cc31285b83bbe569755d909d91b559db2d6ce3bca2fcc075225364
-
SHA512
5364d0944b4be215fb5d8bb8398e965ff6fa3190a962dd6c491984482321756017f89c2242d77ebcce6666c31fe54a956f2eb3a03a95d64121a1db462ad20a0d
-
SSDEEP
192:Q6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTtK72dwF7dBdcQOz:Q6JaVh4I5rpPbTt+BdhO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2756 2708 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2684 wrote to memory of 2708 2684 rundll32.exe 30 PID 2708 wrote to memory of 2756 2708 rundll32.exe 31 PID 2708 wrote to memory of 2756 2708 rundll32.exe 31 PID 2708 wrote to memory of 2756 2708 rundll32.exe 31 PID 2708 wrote to memory of 2756 2708 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2483⤵
- Program crash
PID:2756
-
-