Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6a12cac9c5f7567e45a9a68895a9f92fc05bc9b33323a38baf64647bbfd0a3f3.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_6a12cac9c5f7567e45a9a68895a9f92fc05bc9b33323a38baf64647bbfd0a3f3.dll
-
Size
184KB
-
MD5
b552f5c7addc5657e217d3bc2f712348
-
SHA1
27a120d373aaa256b7e957114d5be6be6348325e
-
SHA256
6a12cac9c5f7567e45a9a68895a9f92fc05bc9b33323a38baf64647bbfd0a3f3
-
SHA512
0943d0129fa463bad66dd2f9546f51265547eeb2c27a19afc018fa5ad9cd3b3de4ab423fa2dee911b3e168565b9e3dbd7710cf7f9afba22af0b9c7a91d7adb66
-
SSDEEP
3072:JiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoclzoxss7:JiLVCIT4WK2z1W+CUHZj4Skq/eaoioC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/2376-1-0x0000000075880000-0x00000000758AF000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1184 2376 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 116 wrote to memory of 2376 116 rundll32.exe 82 PID 116 wrote to memory of 2376 116 rundll32.exe 82 PID 116 wrote to memory of 2376 116 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a12cac9c5f7567e45a9a68895a9f92fc05bc9b33323a38baf64647bbfd0a3f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a12cac9c5f7567e45a9a68895a9f92fc05bc9b33323a38baf64647bbfd0a3f3.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 6163⤵
- Program crash
PID:1184
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 23761⤵PID:4792