Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7eb3b28c3e7...18.exe
windows7-x64
3eb3b28c3e7...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/msearch.exe
windows7-x64
7$TEMP/msearch.exe
windows10-2004-x64
7Monkey3.exe
windows7-x64
Monkey3.exe
windows10-2004-x64
Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 11:24
Behavioral task
behavioral1
Sample
eb3b28c3e78c852f9ac378afc5483e94_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eb3b28c3e78c852f9ac378afc5483e94_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/msearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$TEMP/msearch.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Monkey3.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Monkey3.exe
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
d970f6e5200a676ded18b2dfb39a3352
-
SHA1
1d48fb37758c09f3f2a083a2869143383b68daec
-
SHA256
c2ae27669651fd5d3142e35d3317f46b7b3a9683b49f93ccf575628d55e8a6da
-
SHA512
86798df839c84e2dae4596f5b210edd18feaf8637ebe7925b7d80015ff321d324da47f129b91fb1c3229cac8d4f45de5758069a3e7cce7c9dd2d19e305131982
-
SSDEEP
192:s6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTtK72dwF7dBdcQOz:s6JaVh4I5rpPbTt+BdhO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2160 860 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1220 wrote to memory of 860 1220 rundll32.exe 89 PID 1220 wrote to memory of 860 1220 rundll32.exe 89 PID 1220 wrote to memory of 860 1220 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 6363⤵
- Program crash
PID:2160
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 860 -ip 8601⤵PID:4624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:81⤵PID:4304