Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a6f9852169c6a9df376270ebd71c8c72275b2410b654d1c0387ec2925d0e5705.dll
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_a6f9852169c6a9df376270ebd71c8c72275b2410b654d1c0387ec2925d0e5705.dll
-
Size
204KB
-
MD5
f94a130cdbbc735f6f26d63b98dfb68b
-
SHA1
12a5bebccc42bb99da90b549985f5d31cc8b93b3
-
SHA256
a6f9852169c6a9df376270ebd71c8c72275b2410b654d1c0387ec2925d0e5705
-
SHA512
fc3c4278c6a7dc381dcc6680a07601041f0897d2fa5685dc9664176cb3cf60adad270825f6e140c425d8eb2dc6daae5dc3615ab9ed60f3158191503b1b72f2bf
-
SSDEEP
3072:06FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:0ZuX6pEaeEDheWa+Jc9bhorfTw
Malware Config
Extracted
dridex
40111
45.58.56.12:443
162.241.54.59:6601
51.91.76.89:2303
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/4984-1-0x0000000074950000-0x0000000074985000-memory.dmp dridex_ldr behavioral2/memory/4984-4-0x0000000074950000-0x0000000074985000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 336 wrote to memory of 4984 336 rundll32.exe 83 PID 336 wrote to memory of 4984 336 rundll32.exe 83 PID 336 wrote to memory of 4984 336 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6f9852169c6a9df376270ebd71c8c72275b2410b654d1c0387ec2925d0e5705.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a6f9852169c6a9df376270ebd71c8c72275b2410b654d1c0387ec2925d0e5705.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4984
-