Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
715b79fd130...18.exe
windows7-x64
715b79fd130...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDIR/xml.dll
windows7-x64
3$PLUGINSDIR/xml.dll
windows10-2004-x64
3Star Cursor.exe
windows7-x64
3Star Cursor.exe
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 01:57
Behavioral task
behavioral1
Sample
15b79fd1307f3a654284678c27095fa2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15b79fd1307f3a654284678c27095fa2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/locate.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/locate.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Star Cursor.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Star Cursor.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
uninst.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
uninst.exe
Resource
win10v2004-20240802-en
General
-
Target
Star Cursor.exe
-
Size
25KB
-
MD5
1fde8d9d99e4ac1b40c1ae0ced500217
-
SHA1
50e7dfdb4a50277e1f9c7759c6eea84321e62a22
-
SHA256
f5befa75203dd851b2b162e468678bf0c6dffb45e7a745e460f48eef547cefe9
-
SHA512
398da1314ed43c331fd57333aafd2d96c4899ba4ade3ab90805b54ce5c13aa53e2690ea699db633953b9ca00b1b221a28f16f43e4ba29d3d7269e6360705d172
-
SSDEEP
384:xexD5cXYBCi+c++8a89Yzc3bO7z7sVuQlA1YDbWAxar6+e9Pfqbn1v:4D5coBocm3bO7EEQmsNxFha5v
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Star Cursor.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 Star Cursor.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2492 Star Cursor.exe