Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_666fb16a42c487261b1c6a5cdbceac5262b1edd81f95a8b77c8364af8f331d63.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_666fb16a42c487261b1c6a5cdbceac5262b1edd81f95a8b77c8364af8f331d63.dll
-
Size
204KB
-
MD5
2136ca31113cd9802d75ffb6285026fe
-
SHA1
e8a431204f7161c165708005fd6a93f4070ac0f9
-
SHA256
666fb16a42c487261b1c6a5cdbceac5262b1edd81f95a8b77c8364af8f331d63
-
SHA512
3c20ef11d0617753acae062bf67a986ac68bd45b651fcad71d965ae3f941f42cebe88b609bdb0b2aba0bc3b434bcc753be8ed745b9c0058a81bb179e05596e16
-
SSDEEP
3072:K6FOf6h8i6pdDPvaaeEGObTS/HaoGoK9kN+Jcr9bhrFKL3fJpwZ:KZuX6pEaeEDheWa+Jc9bhorfTw
Malware Config
Extracted
dridex
40111
45.58.56.12:443
162.241.54.59:6601
51.91.76.89:2303
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/3492-1-0x0000000074F00000-0x0000000074F35000-memory.dmp dridex_ldr behavioral2/memory/3492-2-0x0000000074F00000-0x0000000074F35000-memory.dmp dridex_ldr -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1268 wrote to memory of 3492 1268 rundll32.exe 83 PID 1268 wrote to memory of 3492 1268 rundll32.exe 83 PID 1268 wrote to memory of 3492 1268 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_666fb16a42c487261b1c6a5cdbceac5262b1edd81f95a8b77c8364af8f331d63.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_666fb16a42c487261b1c6a5cdbceac5262b1edd81f95a8b77c8364af8f331d63.dll,#12⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3492
-