Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9db5226e0ec1e7bc9300a8c109a4bc8b4206a791105da0f75304f595f487cba5.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_9db5226e0ec1e7bc9300a8c109a4bc8b4206a791105da0f75304f595f487cba5.dll
-
Size
177KB
-
MD5
37db18c4c73f505fc38db2c9fa635fd9
-
SHA1
dba465814e9ffa1c301f6b2daa2c13add7ac1bf7
-
SHA256
9db5226e0ec1e7bc9300a8c109a4bc8b4206a791105da0f75304f595f487cba5
-
SHA512
c4df19fcdb03bf860e209af0c8ac144d321257aeadf10924cf853c48767050ef27331c71e55578518d5c4e05f40e7e8b049fa8882033f5943754cec7b3c03b15
-
SSDEEP
3072:HuCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:DzWxkOP4p2EesvcDi6DOHPJ
Malware Config
Extracted
dridex
22201
144.76.1.150:443
50.249.212.98:23399
104.168.154.79:5007
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/1768-0-0x0000000074FE0000-0x0000000075011000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2452 1768 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 376 wrote to memory of 1768 376 rundll32.exe 30 PID 1768 wrote to memory of 2452 1768 rundll32.exe 31 PID 1768 wrote to memory of 2452 1768 rundll32.exe 31 PID 1768 wrote to memory of 2452 1768 rundll32.exe 31 PID 1768 wrote to memory of 2452 1768 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9db5226e0ec1e7bc9300a8c109a4bc8b4206a791105da0f75304f595f487cba5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9db5226e0ec1e7bc9300a8c109a4bc8b4206a791105da0f75304f595f487cba5.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 2203⤵
- Program crash
PID:2452
-
-