Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_b36937c3fefcd1df032ac2900df91e9e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b36937c3fefcd1df032ac2900df91e9e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/awjx.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/awjx.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/awjx.dll
-
Size
20KB
-
MD5
213e480b87636c56a73a61de53f0c3c8
-
SHA1
0425ea30b6ae2eca54a8e55e1b7950dc0f5c1412
-
SHA256
f8c73afa54aeed213fe0f60b0f3fd7e95ad292941a1dcd7cb9d94dc3b0571637
-
SHA512
7b326838f0a8a214a932f58c66a37b0d6c7972e0ec089f7528c34041b8891c4a4b71d99d7630ff5c4bcbca83cd2aa25b4e8da30bdb1755339aa7ee5d079a4d34
-
SSDEEP
384:1MO3lld/IM9avqotPg761Zl4ODA23hN28BfYe:1v3lldQM9Gg21oOpzdV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4040 2916 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2916 2528 rundll32.exe 83 PID 2528 wrote to memory of 2916 2528 rundll32.exe 83 PID 2528 wrote to memory of 2916 2528 rundll32.exe 83 PID 2916 wrote to memory of 3496 2916 rundll32.exe 84 PID 2916 wrote to memory of 3496 2916 rundll32.exe 84 PID 2916 wrote to memory of 3496 2916 rundll32.exe 84 PID 2916 wrote to memory of 3496 2916 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\awjx.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\awjx.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\awjx.dll,#13⤵PID:3496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 6963⤵
- Program crash
PID:4040
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2916 -ip 29161⤵PID:4204