Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 13:00 UTC
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a9d310bada6fcf74edf9b9f64821c9e9f6af3c1dec5dc2f7206d39a6ef8b7189.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_a9d310bada6fcf74edf9b9f64821c9e9f6af3c1dec5dc2f7206d39a6ef8b7189.dll
-
Size
184KB
-
MD5
43552527b43b1ca15d7b71a4fd43edcc
-
SHA1
3b94bd898d7921760a004139dc091e4a5fb5aafd
-
SHA256
a9d310bada6fcf74edf9b9f64821c9e9f6af3c1dec5dc2f7206d39a6ef8b7189
-
SHA512
cbfdea06ecb0dbb07f7ec7d815965c2559680f92f3f42986259dffc0645542d782bde851eca192266bb78138e7007fa8b0b33a424e2d54dc34dbbb358b5ddc20
-
SSDEEP
3072:fiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoPlzoxss7:fiLVCIT4WK2z1W+CUHZj4Skq/eaoNoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/3240-1-0x0000000074E70000-0x0000000074E9F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 460 3240 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3416 wrote to memory of 3240 3416 rundll32.exe 85 PID 3416 wrote to memory of 3240 3416 rundll32.exe 85 PID 3416 wrote to memory of 3240 3416 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9d310bada6fcf74edf9b9f64821c9e9f6af3c1dec5dc2f7206d39a6ef8b7189.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a9d310bada6fcf74edf9b9f64821c9e9f6af3c1dec5dc2f7206d39a6ef8b7189.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 6163⤵
- Program crash
PID:460
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3240 -ip 32401⤵PID:5084
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
75.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa