Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5d97a78c0c101fa2a7ee26d0858d6612e0df7477f2f5ea35bdae5c1d37c6c3a2.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_5d97a78c0c101fa2a7ee26d0858d6612e0df7477f2f5ea35bdae5c1d37c6c3a2.dll
-
Size
184KB
-
MD5
fb2ce8f66a6d95ca072f3fa53648dddf
-
SHA1
02a18764cee7005883ada60ff9e730aaa0d930cb
-
SHA256
5d97a78c0c101fa2a7ee26d0858d6612e0df7477f2f5ea35bdae5c1d37c6c3a2
-
SHA512
4aeade9a6b241ad06ab668beb7e21fe085689bc51c2c6867aec200d9cbe0137fd0cbd85ad88ed8d5eb2828ae87aed6d6675db0461aacd440d63dc51756868165
-
SSDEEP
3072:xiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eaoYlzoxss7:xiLVCIT4WK2z1W+CUHZj4Skq/eaoGoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1796-1-0x0000000075610000-0x000000007563F000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 640 1796 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4224 wrote to memory of 1796 4224 rundll32.exe 82 PID 4224 wrote to memory of 1796 4224 rundll32.exe 82 PID 4224 wrote to memory of 1796 4224 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d97a78c0c101fa2a7ee26d0858d6612e0df7477f2f5ea35bdae5c1d37c6c3a2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d97a78c0c101fa2a7ee26d0858d6612e0df7477f2f5ea35bdae5c1d37c6c3a2.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 6163⤵
- Program crash
PID:640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1796 -ip 17961⤵PID:1780