Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 06:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ff350d505f1619e84beac29538c58ac440d408ee9bb0c850688526dfb08fa1b6.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_ff350d505f1619e84beac29538c58ac440d408ee9bb0c850688526dfb08fa1b6.dll
-
Size
161KB
-
MD5
ac7034347b3ea347931e20b4154ccf42
-
SHA1
08f008f1b93f4104c4d1a554500a4eaa44f01af9
-
SHA256
ff350d505f1619e84beac29538c58ac440d408ee9bb0c850688526dfb08fa1b6
-
SHA512
8fe658875b867c9840b114495e2248f8fc51e0d2b1c25d5f545a10e9d4a1c3307728ff44351455eaf3a4703cf6f4238868baba9eb1a38a7fd2e4acc86637948a
-
SSDEEP
3072:ltSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2TGkFY:fnS62Fl+pkeJl3CvRStrFl+EYi
Malware Config
Extracted
dridex
22202
78.46.73.125:443
185.148.168.26:2303
66.113.160.126:8172
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1724-1-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr behavioral2/memory/1724-2-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2464 1724 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 748 wrote to memory of 1724 748 rundll32.exe 82 PID 748 wrote to memory of 1724 748 rundll32.exe 82 PID 748 wrote to memory of 1724 748 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff350d505f1619e84beac29538c58ac440d408ee9bb0c850688526dfb08fa1b6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff350d505f1619e84beac29538c58ac440d408ee9bb0c850688526dfb08fa1b6.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 7123⤵
- Program crash
PID:2464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1724 -ip 17241⤵PID:2364