Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9842da918588da0a597cef9e529bfb0_JaffaCakes118.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
e9842da918588da0a597cef9e529bfb0_JaffaCakes118.dll
-
Size
184KB
-
MD5
e9842da918588da0a597cef9e529bfb0
-
SHA1
c779d9c229db97ad539343f2f1bc8fd5282daaf8
-
SHA256
bfb67eb7b8aa4632ace65f504e96269c18ec4eb163d1afc3419d085e576d877d
-
SHA512
f50f24ccfda6322dfa0398c7d22bf766f6bf927da7d12dc8a87d5d1782f642b898af996d2c00b939b8039918db444a20d116b99e8411c2610c52551fa7fbabb2
-
SSDEEP
3072:bhd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JEVQcY:b3fOeIv54W6SFKfc9me9v9/JEV
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
51.79.50.122:443
222.124.142.67:10443
138.201.222.158:4664
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2040-0-0x0000000074A50000-0x0000000074A80000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2992 2040 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2908 wrote to memory of 2040 2908 rundll32.exe 28 PID 2040 wrote to memory of 2992 2040 rundll32.exe 29 PID 2040 wrote to memory of 2992 2040 rundll32.exe 29 PID 2040 wrote to memory of 2992 2040 rundll32.exe 29 PID 2040 wrote to memory of 2992 2040 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9842da918588da0a597cef9e529bfb0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9842da918588da0a597cef9e529bfb0_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 2883⤵
- Program crash
PID:2992
-
-