Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
53f72f13b6e...18.exe
windows7-x64
33f72f13b6e...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3Alawar.url
windows7-x64
6Alawar.url
windows10-2004-x64
3HTMLayout.dll
windows7-x64
3HTMLayout.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 10:55
Behavioral task
behavioral1
Sample
3f72f13b6e2369b55ab89ee2cdfadc67_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3f72f13b6e2369b55ab89ee2cdfadc67_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Alawar.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Alawar.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
HTMLayout.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
HTMLayout.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
e2a32b7677bc80f6e71e42ec5a2753cc
-
SHA1
7856bebedba259040c4d7c4a07deda1c425934af
-
SHA256
547c8edb38bf227afe084562f9fe6e82d13ab17650adf3a3dd5460aea928e9ef
-
SHA512
bfa8b7d22f7df34a4a31650a138a4ac7f323fbc74b2bb68203a1cd3c7936a5183e79727816c00ebb429f775ac06a3a26b81a8a482fd550d0253fc407bd480daf
-
SSDEEP
96:Z++BC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5t4GhEl5VN:Z+2epxPE1r8/FtmCDt3g5v
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2656 2380 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2364 wrote to memory of 2380 2364 rundll32.exe 30 PID 2380 wrote to memory of 2656 2380 rundll32.exe 31 PID 2380 wrote to memory of 2656 2380 rundll32.exe 31 PID 2380 wrote to memory of 2656 2380 rundll32.exe 31 PID 2380 wrote to memory of 2656 2380 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2243⤵
- Program crash
PID:2656
-
-