Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 02:10
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6374d93f10cb8aa04c68685fc0768d76284d7033c8f157399f17a15b180b9ebb.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6374d93f10cb8aa04c68685fc0768d76284d7033c8f157399f17a15b180b9ebb.dll
-
Size
162KB
-
MD5
f3daa028caae274ea7cc06581418f288
-
SHA1
6996654a7f04d3a76ef0e0d9091ec91ced8a829e
-
SHA256
6374d93f10cb8aa04c68685fc0768d76284d7033c8f157399f17a15b180b9ebb
-
SHA512
732ce0019b98ffcfaa03a6e9bbeda1a331bf33e3a540bd25d8cb7b067594cde9988b984edcd4ce5c0824873908bb4453cd74eb6bd93738db17cb8f466bd496aa
-
SSDEEP
3072:hesl4+VdlY+01jb5SA5hg9PTEfPa1x+pq0KbuFicLJL:d4+VZQpt5hyPsa1ekiEyL
Malware Config
Extracted
dridex
22202
203.114.109.124:443
82.165.145.100:6601
94.177.255.18:8172
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1044-1-0x0000000010000000-0x000000001002D000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4620 1044 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3620 wrote to memory of 1044 3620 rundll32.exe 82 PID 3620 wrote to memory of 1044 3620 rundll32.exe 82 PID 3620 wrote to memory of 1044 3620 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6374d93f10cb8aa04c68685fc0768d76284d7033c8f157399f17a15b180b9ebb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6374d93f10cb8aa04c68685fc0768d76284d7033c8f157399f17a15b180b9ebb.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 7123⤵
- Program crash
PID:4620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1044 -ip 10441⤵PID:4224