Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a98b87d32e9d01aeae4097c44e9af4f7e25269d954433c1a75ef17015ab106db.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_a98b87d32e9d01aeae4097c44e9af4f7e25269d954433c1a75ef17015ab106db.dll
-
Size
188KB
-
MD5
2e04d94bf60e68321499e11842205c74
-
SHA1
211a0024e3ace1d293b1f3c51c597352a952acb1
-
SHA256
a98b87d32e9d01aeae4097c44e9af4f7e25269d954433c1a75ef17015ab106db
-
SHA512
ccf35a63e46d99749f5c532006241c396f755fdb89be2db807499f0939ffbd2a27a8ab8092a2477374ccb218f9668123abbd49b5dad292035d5f4e65a173b65e
-
SSDEEP
3072:AteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:Uq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/5012-1-0x0000000075450000-0x0000000075480000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1996 5012 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4148 wrote to memory of 5012 4148 rundll32.exe 83 PID 4148 wrote to memory of 5012 4148 rundll32.exe 83 PID 4148 wrote to memory of 5012 4148 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a98b87d32e9d01aeae4097c44e9af4f7e25269d954433c1a75ef17015ab106db.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a98b87d32e9d01aeae4097c44e9af4f7e25269d954433c1a75ef17015ab106db.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 6923⤵
- Program crash
PID:1996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 50121⤵PID:3656