Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5f2baeae44281f88a6d878251a0fc4ad6b708b108f3ad05ce9d4feabf10b5f90.dll
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_5f2baeae44281f88a6d878251a0fc4ad6b708b108f3ad05ce9d4feabf10b5f90.dll
-
Size
178KB
-
MD5
68068df9c7981ca3aa7335870a9c2b63
-
SHA1
7ed10f7923de3dfdee67205097a557098c1336dc
-
SHA256
5f2baeae44281f88a6d878251a0fc4ad6b708b108f3ad05ce9d4feabf10b5f90
-
SHA512
0bedb2b3a6d7611a8c349554c9cda8c0d7b76b1686209fed9469768fc2792107a8b577a706fabbd4e1f24ae83a81ca6bb7679c002fb88f1fc98a2e8be1852e68
-
SSDEEP
3072:iZUVAk9rsXo3/Ifz/uUXF2mSPBxv1tM7lt8jPU6/pyagsuAtlUucGZ2:iUAk9I4vgz/V2dulz6/hvOhG
Malware Config
Extracted
dridex
22201
142.93.223.149:443
128.199.36.62:4664
50.116.54.215:13786
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/1272-1-0x0000000075140000-0x0000000075171000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30 PID 2076 wrote to memory of 1272 2076 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2baeae44281f88a6d878251a0fc4ad6b708b108f3ad05ce9d4feabf10b5f90.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f2baeae44281f88a6d878251a0fc4ad6b708b108f3ad05ce9d4feabf10b5f90.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1272
-