Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_521d05303a3f43b43f899ce752cd62e1ebb687fbad630d8af6455c96608e8cc8.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_521d05303a3f43b43f899ce752cd62e1ebb687fbad630d8af6455c96608e8cc8.dll
-
Size
163KB
-
MD5
5704364025aa376f1ac7a9574f88ed48
-
SHA1
a0ed503bdb5ec89016405b5f6da909de4b97d843
-
SHA256
521d05303a3f43b43f899ce752cd62e1ebb687fbad630d8af6455c96608e8cc8
-
SHA512
6adf640e41ebc038d32c9d26b6c4e83dd8de7e07dff582bf719d56801d1778579b9e2e17990ef3c1df449871531a55d760f7f602fb906f2a386f09729ad8eff4
-
SSDEEP
3072:g9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:g9F6rQXvFczvYpQP
Malware Config
Extracted
dridex
22201
43.229.206.212:443
82.209.17.209:8172
162.241.209.225:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/4420-0-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 4464 4420 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4420 4692 rundll32.exe 83 PID 4692 wrote to memory of 4420 4692 rundll32.exe 83 PID 4692 wrote to memory of 4420 4692 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_521d05303a3f43b43f899ce752cd62e1ebb687fbad630d8af6455c96608e8cc8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_521d05303a3f43b43f899ce752cd62e1ebb687fbad630d8af6455c96608e8cc8.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 7083⤵
- Program crash
PID:4464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4420 -ip 44201⤵PID:1844