Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_19845923276fa859a3658c92339fd035c7434a5382397d57bc1707ab96d45876.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_19845923276fa859a3658c92339fd035c7434a5382397d57bc1707ab96d45876.dll
-
Size
188KB
-
MD5
ce92317fdb921d05f92314940d4448d3
-
SHA1
465aee9a8411d58d600a28d662959e0b6d4e8ff1
-
SHA256
19845923276fa859a3658c92339fd035c7434a5382397d57bc1707ab96d45876
-
SHA512
5c4535cbafa08dbe166c82b54489f514c0cbde90064e07db9b322b2d5aeb4e31d22f7ad2be7be93b1c64e689919f865f71154f40531ba12b2d494ea418a6050e
-
SSDEEP
3072:wteMq7hp/YIzA6BZvlWnTDN2GL9L8NLXWruiuUCzTOwwc0cIzX9qM:kq7fYIHBZkTB6DWruUCOwjt
Malware Config
Extracted
dridex
22201
103.87.173.60:443
45.32.243.209:8116
207.180.208.54:4664
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/2568-1-0x00000000749D0000-0x0000000074A00000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2380 2568 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2116 wrote to memory of 2568 2116 rundll32.exe 30 PID 2568 wrote to memory of 2380 2568 rundll32.exe 31 PID 2568 wrote to memory of 2380 2568 rundll32.exe 31 PID 2568 wrote to memory of 2380 2568 rundll32.exe 31 PID 2568 wrote to memory of 2380 2568 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19845923276fa859a3658c92339fd035c7434a5382397d57bc1707ab96d45876.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19845923276fa859a3658c92339fd035c7434a5382397d57bc1707ab96d45876.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 3083⤵
- Program crash
PID:2380
-
-