Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/NSISdl.dll
-
Size
72KB
-
MD5
b13935bfa7a3e43c112bd9fa02f08f28
-
SHA1
dec4f136057097c412f53c2ae41b80a8ad0c6810
-
SHA256
796f7efb91904fa4105528e18f6f87e3fdab9a070dabef83e02f9ae375b2b060
-
SHA512
1b92cde7bf74fc181b4d2602a269ef1f581b75eb67e3e46b256ddaddc153b95ee17d422a56ca04d68eafe61ab468b708f7f3691f3b47c554a67af00d49b2709a
-
SSDEEP
1536:Xq1go754oPtqTbIrKZYexTTvIUQt85rFmTwHoUgyX:Xqh14oPtjp6vIUQt85rboUgyX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2528 2560 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2440 wrote to memory of 2560 2440 rundll32.exe 30 PID 2560 wrote to memory of 2528 2560 rundll32.exe 31 PID 2560 wrote to memory of 2528 2560 rundll32.exe 31 PID 2560 wrote to memory of 2528 2560 rundll32.exe 31 PID 2560 wrote to memory of 2528 2560 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 2243⤵
- Program crash
PID:2528
-
-