Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/12/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e388a7f486b96b8af2de819f79aa3c34a34825f19c1fe506e6551e94c52ddd9a.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_e388a7f486b96b8af2de819f79aa3c34a34825f19c1fe506e6551e94c52ddd9a.dll
-
Size
164KB
-
MD5
9d1360bfb0e19c010df6093ed75a2987
-
SHA1
afeda5de8220d05c00add4631e0d533612c816a8
-
SHA256
e388a7f486b96b8af2de819f79aa3c34a34825f19c1fe506e6551e94c52ddd9a
-
SHA512
38b3466ab4160be1a10549821ec596da0e4bf8fd0e56cfede61aece1032d3e46a3d5de991c2c9e9191d1f72f578f9f7237227f4da9c14d9f1d516ac5dc18cbf8
-
SSDEEP
3072:jBefihU8fQ2Sob/xg+eNV1A1I3aiI8i3GdVAzuECtNjP3/3ioP7y11a0E:jBefiv/12+2A1AIpFzxCtNjHSoPm11J
Malware Config
Extracted
dridex
22202
45.123.40.54:443
82.209.17.209:8172
180.250.21.2:13721
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2772-0-0x0000000010000000-0x000000001002F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2680 2772 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2772 wrote to memory of 2680 2772 rundll32.exe 32 PID 2772 wrote to memory of 2680 2772 rundll32.exe 32 PID 2772 wrote to memory of 2680 2772 rundll32.exe 32 PID 2772 wrote to memory of 2680 2772 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e388a7f486b96b8af2de819f79aa3c34a34825f19c1fe506e6551e94c52ddd9a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e388a7f486b96b8af2de819f79aa3c34a34825f19c1fe506e6551e94c52ddd9a.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2363⤵
- Program crash
PID:2680
-
-