Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 19:30

General

  • Target

    JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll

  • Size

    160KB

  • MD5

    9a9da1facf1de719d644a336cd51eff3

  • SHA1

    5bb91a3f23fa37f283e375c38a1eb980f64e3f6c

  • SHA256

    850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0

  • SHA512

    30042d5a873f8de99b441263c2f4e05a9bd63bdabc1d5917e8b167d1076a2111404073a284b9bf8f719c39fca4c7f1acb31f43fde35425ad946c4e7de047a999

  • SSDEEP

    3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3

Malware Config

Extracted

Family

dridex

Botnet

40111

C2

94.247.168.64:443

159.203.93.122:8172

50.116.27.97:2303

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_850393f0275e54a15b9b7b565f87f9ff1a2f51546e4aff7b27cd8f0f7ab3bfa0.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1916-0-0x0000000000170000-0x0000000000176000-memory.dmp

    Filesize

    24KB

  • memory/1916-1-0x0000000074C90000-0x0000000074CBE000-memory.dmp

    Filesize

    184KB

  • memory/1916-4-0x0000000000170000-0x0000000000176000-memory.dmp

    Filesize

    24KB

  • memory/1916-3-0x0000000074C90000-0x0000000074CBE000-memory.dmp

    Filesize

    184KB