Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_444084ad30512a85a118558967e4972e8d4e966850fdf7ae8c387b967c4e9994.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_444084ad30512a85a118558967e4972e8d4e966850fdf7ae8c387b967c4e9994.dll
-
Size
184KB
-
MD5
ae76eea897d0184d991a0c20ae183197
-
SHA1
df0cfa751da5b7f2c152b57fdcc19fc3f9d849a9
-
SHA256
444084ad30512a85a118558967e4972e8d4e966850fdf7ae8c387b967c4e9994
-
SHA512
cb74aef990e83a053c8b24b9f75a232e30bab6597448589a7f842a55332b0928035e1d711bd20cfabbf7dcb66ee8db55188356b00276eb8f37972b96869c16a1
-
SSDEEP
3072:6iLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eao7lzoxss7:6iLVCIT4WK2z1W+CUHZj4Skq/eaoBoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2520-1-0x0000000074940000-0x000000007496F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1048 2520 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4448 wrote to memory of 2520 4448 rundll32.exe 84 PID 4448 wrote to memory of 2520 4448 rundll32.exe 84 PID 4448 wrote to memory of 2520 4448 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_444084ad30512a85a118558967e4972e8d4e966850fdf7ae8c387b967c4e9994.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_444084ad30512a85a118558967e4972e8d4e966850fdf7ae8c387b967c4e9994.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 6163⤵
- Program crash
PID:1048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2520 -ip 25201⤵PID:3912