Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3c20c9a6a0a8b68be0ef09d451cf5a41d9ace5f203b776f127a233ea8167147e.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3c20c9a6a0a8b68be0ef09d451cf5a41d9ace5f203b776f127a233ea8167147e.dll
-
Size
188KB
-
MD5
ec6032062f93cf78b914b38e1d6448bd
-
SHA1
d3f1ec477db0958188e81977cfd21d24d48ea072
-
SHA256
3c20c9a6a0a8b68be0ef09d451cf5a41d9ace5f203b776f127a233ea8167147e
-
SHA512
730a8848dc84ddf984ac78e990ece028e5b8cf0f85ee6e9698f077cc82841526d031ccde0218619e3e6250d104281a12e31c9f75741e9d7d14393226fd0ad4ed
-
SSDEEP
3072:xteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzA9qM:dq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1980-1-0x0000000074F40000-0x0000000074F70000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4040 1980 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1980 1596 rundll32.exe 82 PID 1596 wrote to memory of 1980 1596 rundll32.exe 82 PID 1596 wrote to memory of 1980 1596 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c20c9a6a0a8b68be0ef09d451cf5a41d9ace5f203b776f127a233ea8167147e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c20c9a6a0a8b68be0ef09d451cf5a41d9ace5f203b776f127a233ea8167147e.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 6923⤵
- Program crash
PID:4040
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1980 -ip 19801⤵PID:2024