Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll
-
Size
160KB
-
MD5
9a9da1facf1de719d644a336cd51eff3
-
SHA1
5bb91a3f23fa37f283e375c38a1eb980f64e3f6c
-
SHA256
850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0
-
SHA512
30042d5a873f8de99b441263c2f4e05a9bd63bdabc1d5917e8b167d1076a2111404073a284b9bf8f719c39fca4c7f1acb31f43fde35425ad946c4e7de047a999
-
SSDEEP
3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3
Malware Config
Extracted
dridex
40111
94.247.168.64:443
159.203.93.122:8172
50.116.27.97:2303
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/1916-1-0x0000000074C90000-0x0000000074CBE000-memory.dmp dridex_ldr behavioral1/memory/1916-3-0x0000000074C90000-0x0000000074CBE000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30 PID 2972 wrote to memory of 1916 2972 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1916
-