Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ab9d0330fd38da863868611ac51d8c60491ef9428785fb7e00797ff6f8af4259.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_ab9d0330fd38da863868611ac51d8c60491ef9428785fb7e00797ff6f8af4259.dll
-
Size
161KB
-
MD5
7105adf7c2636cee03047cc0d25f441c
-
SHA1
9bf5277c8ab534f70b0e6fdb17ea4484ccb54802
-
SHA256
ab9d0330fd38da863868611ac51d8c60491ef9428785fb7e00797ff6f8af4259
-
SHA512
e119d7244c02f9e43ca347d76b84918d843efba0736a546e8155ff71a0223cbab6be73bdac48f4aa760023b47c3bd405ec861a4f5c7f24fadbf0a4ef18ddb2bf
-
SSDEEP
3072:sz63mpMBf4M8+pwhukvhU7fWaX/77/DZgTmbg+MGaFplA33VBrUXCx3:Sa/jkvhSlP/7bg8aFnA3brJ
Malware Config
Extracted
dridex
22201
193.200.130.181:443
95.138.161.226:2303
167.114.113.13:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2888-1-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2808 2888 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2888 wrote to memory of 2808 2888 rundll32.exe 31 PID 2888 wrote to memory of 2808 2888 rundll32.exe 31 PID 2888 wrote to memory of 2808 2888 rundll32.exe 31 PID 2888 wrote to memory of 2808 2888 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab9d0330fd38da863868611ac51d8c60491ef9428785fb7e00797ff6f8af4259.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab9d0330fd38da863868611ac51d8c60491ef9428785fb7e00797ff6f8af4259.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 2563⤵
- Program crash
PID:2808
-
-