Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
67304bb5c26ccbe7c14180a90c4b8291_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/NSISdl.dll
-
Size
72KB
-
MD5
b13935bfa7a3e43c112bd9fa02f08f28
-
SHA1
dec4f136057097c412f53c2ae41b80a8ad0c6810
-
SHA256
796f7efb91904fa4105528e18f6f87e3fdab9a070dabef83e02f9ae375b2b060
-
SHA512
1b92cde7bf74fc181b4d2602a269ef1f581b75eb67e3e46b256ddaddc153b95ee17d422a56ca04d68eafe61ab468b708f7f3691f3b47c554a67af00d49b2709a
-
SSDEEP
1536:Xq1go754oPtqTbIrKZYexTTvIUQt85rFmTwHoUgyX:Xqh14oPtjp6vIUQt85rboUgyX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5084 3004 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4364 wrote to memory of 3004 4364 rundll32.exe 84 PID 4364 wrote to memory of 3004 4364 rundll32.exe 84 PID 4364 wrote to memory of 3004 4364 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#12⤵PID:3004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 6243⤵
- Program crash
PID:5084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3004 -ip 30041⤵PID:2936