Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
d033c04fe1362e4b6a51cca132b33b69_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d033c04fe1362e4b6a51cca132b33b69_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
f2fc9770e2047526bc45553b940c02fe
-
SHA1
1a189e20eb573d99f4f18e0312dd79865d33f0ac
-
SHA256
b85643e91344506caaeacf97d6ea6dfcf7d62a21b117a516e0162d8f22892639
-
SHA512
b922d9dfc6653809fe6e5af8dfc12f5853d6226e15b0575a7a42c03ab6394773627ae7b63e9e0da72e462169f0f233e93a85082562bf5897bccc480e0be50162
-
SSDEEP
384:tjbs8upT1Vh0N3U4VdbBw9Aahd2aCX+sv:hbs8upidU2fOlgvX+E
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 752 3564 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2572 wrote to memory of 3564 2572 rundll32.exe 83 PID 2572 wrote to memory of 3564 2572 rundll32.exe 83 PID 2572 wrote to memory of 3564 2572 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 6363⤵
- Program crash
PID:752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3564 -ip 35641⤵PID:4692