Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_503fa2ce1c0e2813fedebda2d37634505db4c9a7fff8f143abefa7e1ae72dc11.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_503fa2ce1c0e2813fedebda2d37634505db4c9a7fff8f143abefa7e1ae72dc11.dll
-
Size
161KB
-
MD5
ecfdd53675a2b68495d469bee0251beb
-
SHA1
84af51c5a54daedf9f5d1daff39fb6d02153149b
-
SHA256
503fa2ce1c0e2813fedebda2d37634505db4c9a7fff8f143abefa7e1ae72dc11
-
SHA512
07e611073a741941bfa24d08cdc69c87fa369be4e4023e79acdb6eaf0a0ed09c0fd58e40c07e1d227aafdd32201f253972774a7c8e1f862269c9fe7ff9b2070d
-
SSDEEP
3072:Xm4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:VDBdOlG0nyg1DvwxgZ/v
Malware Config
Extracted
dridex
22202
45.55.134.126:443
67.207.83.96:8172
193.160.214.95:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2428-0-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2548 2428 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 1712 wrote to memory of 2428 1712 rundll32.exe 30 PID 2428 wrote to memory of 2548 2428 rundll32.exe 32 PID 2428 wrote to memory of 2548 2428 rundll32.exe 32 PID 2428 wrote to memory of 2548 2428 rundll32.exe 32 PID 2428 wrote to memory of 2548 2428 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_503fa2ce1c0e2813fedebda2d37634505db4c9a7fff8f143abefa7e1ae72dc11.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_503fa2ce1c0e2813fedebda2d37634505db4c9a7fff8f143abefa7e1ae72dc11.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 2563⤵
- Program crash
PID:2548
-
-