Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_dc42ab3de8fe34572e1dfb61acc16545ee0f03771d2ece3aafebb907ac75157a.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_dc42ab3de8fe34572e1dfb61acc16545ee0f03771d2ece3aafebb907ac75157a.dll
-
Size
184KB
-
MD5
1f5ed993f31d807c29b18641d16b0042
-
SHA1
39170f913f914c17ece01c4c4c6fa696c365d405
-
SHA256
dc42ab3de8fe34572e1dfb61acc16545ee0f03771d2ece3aafebb907ac75157a
-
SHA512
4555c2b33a95c64ce52a5b7a946c386832adce760d7b711e6f7558e35bf8136b0f342bf507e7b9a92e50d3f21501944e1b9838568bbe3d844af437c93fd30a6e
-
SSDEEP
3072:jiLVj+luuUXoPOK2z1WPRgg5YbW+d0Ojk1bSA5q/eao+lzoxss7:jiLVCIT4WK2z1W+CUHZj4Skq/eaocoC
Malware Config
Extracted
dridex
22202
80.241.218.90:443
103.161.172.109:13786
87.98.128.76:5723
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/3852-1-0x0000000075080000-0x00000000750AF000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4048 3852 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3852 2212 rundll32.exe 82 PID 2212 wrote to memory of 3852 2212 rundll32.exe 82 PID 2212 wrote to memory of 3852 2212 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc42ab3de8fe34572e1dfb61acc16545ee0f03771d2ece3aafebb907ac75157a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dc42ab3de8fe34572e1dfb61acc16545ee0f03771d2ece3aafebb907ac75157a.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 6163⤵
- Program crash
PID:4048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3852 -ip 38521⤵PID:2544