Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_05df8c924aa669c2bb436d3e2b778ffc4e6f44580871b9d01bd5a0b37a0b7bed.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_05df8c924aa669c2bb436d3e2b778ffc4e6f44580871b9d01bd5a0b37a0b7bed.dll
-
Size
170KB
-
MD5
57f0764eb09605a17d2a47d5c5c19fce
-
SHA1
1fbadaff3bee5684c227e4d74f1623c98b0dfe99
-
SHA256
05df8c924aa669c2bb436d3e2b778ffc4e6f44580871b9d01bd5a0b37a0b7bed
-
SHA512
f870c95fb1e96f7e77629ec118ec88414f1f94fa9af22886f6e34c2ee7a78fe4d28ca0936310b50c0cfb731af629662f3e2b37116afb733ff6b787477cab3d20
-
SSDEEP
3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm
Malware Config
Extracted
dridex
22201
210.65.244.187:443
162.241.41.92:2303
46.231.204.10:8172
185.183.159.100:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2156-1-0x0000000074730000-0x000000007475F000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30 PID 3068 wrote to memory of 2156 3068 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05df8c924aa669c2bb436d3e2b778ffc4e6f44580871b9d01bd5a0b37a0b7bed.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05df8c924aa669c2bb436d3e2b778ffc4e6f44580871b9d01bd5a0b37a0b7bed.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2156
-