Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6810db61e4cb9c16daa286f5157dbad8a4ba63ab04f16fcf068af9f4c12052a7.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6810db61e4cb9c16daa286f5157dbad8a4ba63ab04f16fcf068af9f4c12052a7.dll
-
Size
184KB
-
MD5
fab8fcdb4cd7e56d74bebb16813b1135
-
SHA1
146bbf5c099867723763122854127a5d36e6b821
-
SHA256
6810db61e4cb9c16daa286f5157dbad8a4ba63ab04f16fcf068af9f4c12052a7
-
SHA512
4af2c6a84bb2573ace1acdaf8acadb85b1e7531eded6e821b938e21c012b56e56ca98fd3f1d7b8f43c973025c635a4917a6fb9656386869c02425f31d32c11d5
-
SSDEEP
3072:tuwfhNXphcqs2tJYsoa9Xibolk0CtPBU1jhhF8ZJ8fDo4K1lmsb:/7TXYsd9SkONU1jKGlelm
Malware Config
Extracted
dridex
22202
103.75.201.2:443
158.223.1.108:6225
165.22.28.242:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/728-1-0x0000000074C30000-0x0000000074C60000-memory.dmp dridex_ldr behavioral2/memory/728-2-0x0000000074C30000-0x0000000074C60000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 5008 728 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4892 wrote to memory of 728 4892 rundll32.exe 83 PID 4892 wrote to memory of 728 4892 rundll32.exe 83 PID 4892 wrote to memory of 728 4892 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6810db61e4cb9c16daa286f5157dbad8a4ba63ab04f16fcf068af9f4c12052a7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6810db61e4cb9c16daa286f5157dbad8a4ba63ab04f16fcf068af9f4c12052a7.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 6163⤵
- Program crash
PID:5008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 728 -ip 7281⤵PID:4548