Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5505a71cffb5050554a949207348bbb97e8d0d34c51254a3e9de242f45c4cba4.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_5505a71cffb5050554a949207348bbb97e8d0d34c51254a3e9de242f45c4cba4.dll
-
Size
161KB
-
MD5
f1ee794068d5b07ad02a69a8c715fbb3
-
SHA1
d04e70b708e31fcfa9044808412934d4f2cc38c2
-
SHA256
5505a71cffb5050554a949207348bbb97e8d0d34c51254a3e9de242f45c4cba4
-
SHA512
b6a7010a8023e1fc4daa1e7584a55a006008a9d4f3ef216242d40fd1492dd66a02fa44b8a2736ceeaa2474826db1a8f7d9d7bffcf44cd9e7cfa24936368ebb01
-
SSDEEP
3072:pk2X+QFg3UutDvUvoU8pz6EJEEhu6Tzace9kuaGA81/YXKHML/Yp8AF:zG3rUvoU4JE/Wzan9T7B/CKsL/Yy
Malware Config
Extracted
dridex
40112
193.200.130.181:443
95.138.161.226:2303
167.114.113.13:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral1/memory/1732-0-0x0000000010000000-0x000000001002E000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30 PID 1716 wrote to memory of 1732 1716 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5505a71cffb5050554a949207348bbb97e8d0d34c51254a3e9de242f45c4cba4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5505a71cffb5050554a949207348bbb97e8d0d34c51254a3e9de242f45c4cba4.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1732
-