Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_68253466629835ba4c1a5216afcd69e622c849eb3b823f9557a22d7b5230ea52.dll
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_68253466629835ba4c1a5216afcd69e622c849eb3b823f9557a22d7b5230ea52.dll
-
Size
188KB
-
MD5
2dc27486d488a9890263b6e46439bfc9
-
SHA1
2ea59558ab08457079d830d4ac93f0e5f1b2c592
-
SHA256
68253466629835ba4c1a5216afcd69e622c849eb3b823f9557a22d7b5230ea52
-
SHA512
98ad68db57f9c62dd37c9ffb04a4f86d9fc500e31b93477cdc5536d32a29696d6635715b1ce486955a54eb0aa6a5967a7d22aefc8764a6589b31398a587527bc
-
SSDEEP
3072:YteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzZ9qM:cq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2424-1-0x0000000074FF0000-0x0000000075020000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2184 2424 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 2424 224 rundll32.exe 83 PID 224 wrote to memory of 2424 224 rundll32.exe 83 PID 224 wrote to memory of 2424 224 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68253466629835ba4c1a5216afcd69e622c849eb3b823f9557a22d7b5230ea52.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68253466629835ba4c1a5216afcd69e622c849eb3b823f9557a22d7b5230ea52.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 6923⤵
- Program crash
PID:2184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2424 -ip 24241⤵PID:5100