Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_15e3f60912bb2e51336716efa13a51c11f031ba4c4f8c2218ec79dd0e409528d.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_15e3f60912bb2e51336716efa13a51c11f031ba4c4f8c2218ec79dd0e409528d.dll
-
Size
177KB
-
MD5
8f68c7d736506ac8fd632a2ac8cdbedd
-
SHA1
a17ac483c1c1b6eec18b3712ef2c01ca36e36dbc
-
SHA256
15e3f60912bb2e51336716efa13a51c11f031ba4c4f8c2218ec79dd0e409528d
-
SHA512
0719d45670125032d7dbd8c941e6fb0e5182271efb75062e7820ce612f3e3261284fff84d27e54b57e476018f3fb772636f5321121e9144a4556cc8d22c085b2
-
SSDEEP
3072:tuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:xzWxkOP4p2EesvcDi6DOHPJ
Malware Config
Extracted
dridex
22201
144.76.1.150:443
50.249.212.98:23399
104.168.154.79:5007
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1636-1-0x0000000074CA0000-0x0000000074CD1000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 312 1636 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1636 2544 rundll32.exe 83 PID 2544 wrote to memory of 1636 2544 rundll32.exe 83 PID 2544 wrote to memory of 1636 2544 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15e3f60912bb2e51336716efa13a51c11f031ba4c4f8c2218ec79dd0e409528d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15e3f60912bb2e51336716efa13a51c11f031ba4c4f8c2218ec79dd0e409528d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 6403⤵
- Program crash
PID:312
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1636 -ip 16361⤵PID:1440