Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3959901e9b3...18.exe
windows7-x64
3959901e9b3...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Puzzle_Blast.exe
windows7-x64
7Puzzle_Blast.exe
windows10-2004-x64
7bass.dll
windows7-x64
3bass.dll
windows10-2004-x64
3mysearch.exe
windows7-x64
7mysearch.exe
windows10-2004-x64
7Analysis
-
max time kernel
138s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
959901e9b3c67ab6ce4cb9d39da0b0aa_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
959901e9b3c67ab6ce4cb9d39da0b0aa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Puzzle_Blast.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Puzzle_Blast.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
bass.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
bass.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
mysearch.exe
Resource
win7-20240704-en
General
-
Target
bass.dll
-
Size
96KB
-
MD5
ee3757788eea4bd71e7779b497a30672
-
SHA1
87eac11f16444f38adf19c8b68087a001bf3704a
-
SHA256
1ec0ae08cd89e542cb32e1ff6206b2d033a4513630f3e00751cc41e57a061a45
-
SHA512
d9f7c06db0a100601d8f81dcdf1f052f6444956c45a2de660847d413abc4e383137e5ca21b9bf79aba106d1451366abd0814d96b7f80189e9f38849fdcd4dec6
-
SSDEEP
1536:vwMJ+mc09Bm36GOr3GitlGjftiwbj9su8WXF+u8+J3hBTN2aSy69ju4UmEM/g:Ikx9Bm365GitEQwbJsdb+J3tn69jxU3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2000 wrote to memory of 4756 2000 rundll32.exe 86 PID 2000 wrote to memory of 4756 2000 rundll32.exe 86 PID 2000 wrote to memory of 4756 2000 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4756
-