Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0bc99fe32cadb6f073648f3fdd4b65b57e7cfe878ba59ec08f8c01554b5e3b7c.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_0bc99fe32cadb6f073648f3fdd4b65b57e7cfe878ba59ec08f8c01554b5e3b7c.dll
-
Size
170KB
-
MD5
90ca4becb1dedcbb1cb3428721b85550
-
SHA1
800add90a6c6e380e3930859aa88ce6cfc92ddcb
-
SHA256
0bc99fe32cadb6f073648f3fdd4b65b57e7cfe878ba59ec08f8c01554b5e3b7c
-
SHA512
8939ddb13554992fd1a7bdf81923900ee1ffb4af8489dbf9b415571a96b4e2beac195d06e09c941958e24c9221fc817ade4fb55ff4a8d6e2b7fb2b03034ade9f
-
SSDEEP
3072:DqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:NVqNd+CIQHXu9VFmu0qU2CJ5
Malware Config
Extracted
dridex
40112
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/408-1-0x0000000075860000-0x0000000075890000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 1844 408 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3440 wrote to memory of 408 3440 rundll32.exe 82 PID 3440 wrote to memory of 408 3440 rundll32.exe 82 PID 3440 wrote to memory of 408 3440 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0bc99fe32cadb6f073648f3fdd4b65b57e7cfe878ba59ec08f8c01554b5e3b7c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0bc99fe32cadb6f073648f3fdd4b65b57e7cfe878ba59ec08f8c01554b5e3b7c.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 6643⤵
- Program crash
PID:1844
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 408 -ip 4081⤵PID:544