Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
772e36e34a1...18.exe
windows7-x64
772e36e34a1...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ch.dll
windows7-x64
3$PLUGINSDI...ch.dll
windows10-2004-x64
3cwd.exe
windows7-x64
3cwd.exe
windows10-2004-x64
3htmlayout.dll
windows7-x64
7htmlayout.dll
windows10-2004-x64
7winzipninfo.html
windows7-x64
3winzipninfo.html
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 06:16
Behavioral task
behavioral1
Sample
72e36e34a1f4e269d07d108d82bdf2a0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
72e36e34a1f4e269d07d108d82bdf2a0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/VPatch.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/VPatch.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
cwd.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cwd.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
htmlayout.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
htmlayout.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
winzipninfo.html
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
winzipninfo.html
Resource
win10v2004-20240709-en
General
-
Target
htmlayout.dll
-
Size
920KB
-
MD5
6ed2f0b1b13e068e0e9377298f2c550d
-
SHA1
8edcb7f3b6b4e578363d12a991a75164a4632521
-
SHA256
5a63558628f3bc939a393a46d1c201a0fb706ee36f39db5375d2cfa2c72c69b0
-
SHA512
4b50e8316d170722c7cd717ca8c700e2b1f790531ea750c7fd88864a5a2add4718aa658231d7ba9c8f25ea4478338474762456322c3dba944b34d791856245b4
-
SSDEEP
24576:h6+0bI4EotRfKHLz70IapiuKKhvTxLAlxXi8iQ:Y+0U4ESRWz70IUqrXi8
Malware Config
Signatures
-
resource yara_rule behavioral9/memory/396-0-0x0000000010000000-0x000000001025B000-memory.dmp upx behavioral9/memory/396-1-0x0000000010000000-0x000000001025B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28 PID 1676 wrote to memory of 396 1676 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlayout.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\htmlayout.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:396
-