Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_30be5937c0f256cdb15cc7d5db5f11bb40141090cd762a612aada4656e46494c.dll
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_30be5937c0f256cdb15cc7d5db5f11bb40141090cd762a612aada4656e46494c.dll
-
Size
188KB
-
MD5
9f861f0be3de5221731f22b0a4ecfd95
-
SHA1
0be859a5d13c9d57d6f9c24e1668c2fb4f018884
-
SHA256
30be5937c0f256cdb15cc7d5db5f11bb40141090cd762a612aada4656e46494c
-
SHA512
da42bf6447bbfd7116c35c5d4ac5f800910df8a6fc041e0044bd8c674db90f2e163fdf4771bcde98541e56fb858a9f9cbd4efcd4f262c0a76e20367c22ac142d
-
SSDEEP
3072:vteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzv9qM:3q7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/4712-1-0x00000000757C0000-0x00000000757F0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4220 4712 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4048 wrote to memory of 4712 4048 rundll32.exe 82 PID 4048 wrote to memory of 4712 4048 rundll32.exe 82 PID 4048 wrote to memory of 4712 4048 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30be5937c0f256cdb15cc7d5db5f11bb40141090cd762a612aada4656e46494c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_30be5937c0f256cdb15cc7d5db5f11bb40141090cd762a612aada4656e46494c.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 6923⤵
- Program crash
PID:4220
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4712 -ip 47121⤵PID:2552