Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_779289b01f692e316cbe92bff86651cd7b918d59ab347bd15e136e2562440fd2.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_779289b01f692e316cbe92bff86651cd7b918d59ab347bd15e136e2562440fd2.dll
-
Size
188KB
-
MD5
5b981f22fa31e84aeb33bda1d89aebf4
-
SHA1
136f39f0259baac76b3c1a6b0dfcf43ae81c135c
-
SHA256
779289b01f692e316cbe92bff86651cd7b918d59ab347bd15e136e2562440fd2
-
SHA512
953088340a994be82c3b33f7338406d4ee67d57860e62cd23cde94ed7e63497c9dd25ba84eb3d0718d874acfa715e083396d31c0cb388b33f264bcc08ee5533d
-
SSDEEP
3072:KteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIz89qM:iq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2124-1-0x0000000074C20000-0x0000000074C50000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 588 2124 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 3024 wrote to memory of 2124 3024 rundll32.exe 31 PID 2124 wrote to memory of 588 2124 rundll32.exe 32 PID 2124 wrote to memory of 588 2124 rundll32.exe 32 PID 2124 wrote to memory of 588 2124 rundll32.exe 32 PID 2124 wrote to memory of 588 2124 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_779289b01f692e316cbe92bff86651cd7b918d59ab347bd15e136e2562440fd2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_779289b01f692e316cbe92bff86651cd7b918d59ab347bd15e136e2562440fd2.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 3003⤵
- Program crash
PID:588
-
-