Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3fd467ed77f...18.exe
windows7-x64
7fd467ed77f...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3Config.dll
windows7-x64
3Config.dll
windows10-2004-x64
3OpenConf.chm
windows7-x64
1OpenConf.chm
windows10-2004-x64
1config/KbdProcs.dll
windows7-x64
3config/KbdProcs.dll
windows10-2004-x64
3config/SubSystems.dll
windows7-x64
3config/SubSystems.dll
windows10-2004-x64
3config/doc...k.html
windows7-x64
3config/doc...k.html
windows10-2004-x64
3config/doc...at.chm
windows7-x64
1config/doc...at.chm
windows10-2004-x64
1config/fdsubst.dll
windows7-x64
3config/fdsubst.dll
windows10-2004-x64
3config/scr...ge.vbs
windows7-x64
1config/scr...ge.vbs
windows10-2004-x64
1config/scr...rts.js
windows7-x64
3config/scr...rts.js
windows10-2004-x64
3config/scr...at.vbs
windows7-x64
1config/scr...at.vbs
windows10-2004-x64
1config/sys...ry.exe
windows7-x64
3config/sys...ry.exe
windows10-2004-x64
3config/sys...er.exe
windows7-x64
3config/sys...er.exe
windows10-2004-x64
3config/sys...ls.exe
windows7-x64
3config/sys...ls.exe
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
fd467ed77f83283caf0c971e108c28fd_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd467ed77f83283caf0c971e108c28fd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Config.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Config.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
OpenConf.chm
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
OpenConf.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
config/KbdProcs.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
config/KbdProcs.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral13
Sample
config/SubSystems.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
config/SubSystems.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
config/docs/OpenConfPowerPack.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
config/docs/OpenConfPowerPack.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
config/docs/telepat.chm
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
config/docs/telepat.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
config/fdsubst.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
config/fdsubst.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
config/scripts/SubSystemsManage.vbs
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
config/scripts/SubSystemsManage.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
config/scripts/SubsystemsReports.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
config/scripts/SubsystemsReports.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
config/scripts/telepat.vbs
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
config/scripts/telepat.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
config/system/ClipboardHistory.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
config/system/ClipboardHistory.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
config/system/StructureUpdater.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
config/system/StructureUpdater.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral31
Sample
config/system/xml2tls/xml2tls.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
config/system/xml2tls/xml2tls.exe
Resource
win10v2004-20240802-en
General
-
Target
Config.dll
-
Size
323KB
-
MD5
efa70d421ebf18b41bf7587d5cb8620e
-
SHA1
6aba02e860d6ebb85db1a124f91a28861d21a679
-
SHA256
17c215792cb51eebb80a8b2e3b0a59424c8b67696b209827c3821c1cb3bc7555
-
SHA512
21317ed2193ac3b4af4cc0afc47224b24707cffda0a5a781b399c23c77aa92e88003620f19de4b36e589e94a79c278a721940c36835da2c4684be466034c0212
-
SSDEEP
6144:RxkSIa5hObjposqP+k74uCp4OZDq6n0oy046xtFebd0Ks0:3kSIa5hObjpoBWk70p460oy0Tabs0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3368 1612 rundll32.exe 82 PID 1612 wrote to memory of 3368 1612 rundll32.exe 82 PID 1612 wrote to memory of 3368 1612 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Config.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Config.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3368
-