Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ecb697f9a4e48c7bd005cf8b1a6e6193_JaffaCakes118.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
ecb697f9a4e48c7bd005cf8b1a6e6193_JaffaCakes118.dll
-
Size
184KB
-
MD5
ecb697f9a4e48c7bd005cf8b1a6e6193
-
SHA1
a6b44350647143111ff0981b988f55ec8921fd6e
-
SHA256
f528952cf768b6ea1ab738b52f642e89c6411e6ce436adc2e470efcf7ebf5357
-
SHA512
1dd17586d5b444d8a96f637df7ff53602f5d93cde4c2721030a58d74aa34645d96c58ad9380a42f7a7102cee4c1110b80bed3126a59c6ac42ce8e322e4cf7a9e
-
SSDEEP
3072:ohd6lp2ffOeP3gv+i4W63iFfKfXM9mQltYwgO226+f33JUVQcY:o3fOeIv54W6SFKfc9me9v9/JUV
Malware Config
Extracted
Family
dridex
Botnet
22201
C2
51.79.50.122:443
222.124.142.67:10443
138.201.222.158:4664
rc4.plain
rc4.plain
Signatures
-
resource yara_rule behavioral1/memory/2796-0-0x0000000074890000-0x00000000748C0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2152 2796 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 848 wrote to memory of 2796 848 rundll32.exe 28 PID 2796 wrote to memory of 2152 2796 rundll32.exe 29 PID 2796 wrote to memory of 2152 2796 rundll32.exe 29 PID 2796 wrote to memory of 2152 2796 rundll32.exe 29 PID 2796 wrote to memory of 2152 2796 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb697f9a4e48c7bd005cf8b1a6e6193_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb697f9a4e48c7bd005cf8b1a6e6193_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 2883⤵
- Program crash
PID:2152
-
-