Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3d63fb5e1aa...18.exe
windows7-x64
7d63fb5e1aa...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...cw.dll
windows7-x64
3$PLUGINSDI...cw.dll
windows10-2004-x64
3Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
d63fb5e1aa0c7de50bca1afc0ce68187_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d63fb5e1aa0c7de50bca1afc0ce68187_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetcw.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetcw.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/inetcw.dll
-
Size
22KB
-
MD5
5b6759d98b6ed62f6f8d501fba6505fa
-
SHA1
f3a9d9e252faba24ff14a8d80e4786d66b20a717
-
SHA256
c97c576acddaa932188ff07f31999ba663b838d77a38eab5aed25553417f613f
-
SHA512
e2bafcdaff8af11efbc90d18fba30762f6054ed08836c4174bd054f5575c7252c8839077d025b3e0fbcc9a2237f47d33b770e0304d43a2616700b78a8dfde310
-
SSDEEP
384:jZ850VpFZuX3rwseU/KyUyjpN3X5P33WpFJDCZwcYa9h9+Bg6IYyPd:l850VPZo2UyRapBVnWbJBaj8A
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4840 4968 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3400 wrote to memory of 4968 3400 rundll32.exe 83 PID 3400 wrote to memory of 4968 3400 rundll32.exe 83 PID 3400 wrote to memory of 4968 3400 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcw.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcw.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 6243⤵
- Program crash
PID:4840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 49681⤵PID:3624