Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
38d58cd27a1...18.exe
windows7-x64
38d58cd27a1...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...et.dll
windows7-x64
3$PLUGINSDI...et.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3repair.exe
windows7-x64
repair.exe
windows10-2004-x64
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
8d58cd27a1fcbdf09debca5148a6e0a9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8d58cd27a1fcbdf09debca5148a6e0a9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Internet.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Internet.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
repair.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
repair.exe
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/Internet.dll
-
Size
4KB
-
MD5
78d026611a970fe14e983a6b9490ea34
-
SHA1
cbf63f3aade515f3fc3fbbcc4e12913f1a472d49
-
SHA256
96100f4ba9563ced97add567f4461541cbe9a085ab5276754bee38dc060a6867
-
SHA512
efbb6bcca88dae073babac2dcf1ad8444c209792cd82820a00483fa365cb899f4979ca29d6ca22de4b975eae2dab8e736a83bc574265925cafcdcfae9cb7915f
-
SSDEEP
48:qw8gNw0WamqZ3XDo5CKNzt9ymk4q4HSIbYvjDkCLL5HqKI:PPWamqRzqN3vH+fJLL5D
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2564 1724 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 3056 wrote to memory of 1724 3056 rundll32.exe 31 PID 1724 wrote to memory of 2564 1724 rundll32.exe 32 PID 1724 wrote to memory of 2564 1724 rundll32.exe 32 PID 1724 wrote to memory of 2564 1724 rundll32.exe 32 PID 1724 wrote to memory of 2564 1724 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 2323⤵
- Program crash
PID:2564
-
-