Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
6026c4c805e1e4e64391cdefd6dca3c9_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
6026c4c805e1e4e64391cdefd6dca3c9_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
6026c4c805e1e4e64391cdefd6dca3c9
-
SHA1
16a93d0e01226a3c5e578609353873b967d37e42
-
SHA256
375b074151ad601e467078321beb924d344b977a8b3594c29596954ed20a9995
-
SHA512
2cd324e04290eab9647a744cf31186ba09239757c8a8daeee68fbc12f00ce08b32a241ad294b11f373f014101d6e67e0c9ad6fc8e82080ef507f48b176f45080
-
SSDEEP
24576:KxumPtwAiyvA/7bGIkFXNr9ypZQf3E/DzLhukd5TkWCf7Zgugu:s3Pvo/3G9XNr2A38XhDTkpf7Zgugu
Malware Config
Extracted
dridex
10444
209.20.87.138:443
198.1.115.153:8172
151.236.29.248:6516
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2488 rundll32.exe 5 2488 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31 PID 1292 wrote to memory of 2488 1292 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6026c4c805e1e4e64391cdefd6dca3c9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6026c4c805e1e4e64391cdefd6dca3c9_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
PID:2488
-