Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5aca7442403612c7522fa294c0b4b6c4fbbcaad0e2a004cf87126f0b6d223096.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_5aca7442403612c7522fa294c0b4b6c4fbbcaad0e2a004cf87126f0b6d223096.dll
-
Size
160KB
-
MD5
37cbf0884839fcbf4a93b243cb4bd567
-
SHA1
7f56570ebdcee3e0238c0fd4a658e1ee780f5b46
-
SHA256
5aca7442403612c7522fa294c0b4b6c4fbbcaad0e2a004cf87126f0b6d223096
-
SHA512
497be74cd7989f5b63863af43d65efe1664dcae8680038c3aa03c3fb781369fdbcec01dca6ac592ba7cbf6f6502cd7483c0c80afbf3daf403bcd8f7185d8821c
-
SSDEEP
3072:2nT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Ny5tAL11fNHYafoMpX
Malware Config
Extracted
dridex
22201
78.46.73.125:443
185.148.168.26:2303
66.113.160.126:8172
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1948-1-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr behavioral2/memory/1948-4-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4028 wrote to memory of 1948 4028 rundll32.exe 83 PID 4028 wrote to memory of 1948 4028 rundll32.exe 83 PID 4028 wrote to memory of 1948 4028 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5aca7442403612c7522fa294c0b4b6c4fbbcaad0e2a004cf87126f0b6d223096.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5aca7442403612c7522fa294c0b4b6c4fbbcaad0e2a004cf87126f0b6d223096.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1948
-