Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d2534142a9c9fed6e1070e1bf2331bbee8a25e2f0b31f1b9d3935a8aa0c693ad.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_d2534142a9c9fed6e1070e1bf2331bbee8a25e2f0b31f1b9d3935a8aa0c693ad.dll
-
Size
177KB
-
MD5
3760ca8bdb6fbf3dc86a39936c639f56
-
SHA1
3b95c1d604ac3d4d65cca8d8918420c9bdabb936
-
SHA256
d2534142a9c9fed6e1070e1bf2331bbee8a25e2f0b31f1b9d3935a8aa0c693ad
-
SHA512
948818dbd0d8a1d7444502bb3a149d5d43cdc5aa02e003197df931b0783be795a1b88985f3a5dbc03e08a789d38fb95e8335d5006d47817596c717690ab186d9
-
SSDEEP
3072:9uCmyBVtWxZCOCA4Hpl1tv18FTETA8ocya/OyoSJPAacbnid8DOHPJ+HJ:BzWxkOP4p2EesvcDi6DOHPJ
Malware Config
Extracted
dridex
22201
144.76.1.150:443
50.249.212.98:23399
104.168.154.79:5007
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1600-1-0x0000000074E20000-0x0000000074E51000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 2236 1600 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1600 1272 rundll32.exe 81 PID 1272 wrote to memory of 1600 1272 rundll32.exe 81 PID 1272 wrote to memory of 1600 1272 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2534142a9c9fed6e1070e1bf2331bbee8a25e2f0b31f1b9d3935a8aa0c693ad.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d2534142a9c9fed6e1070e1bf2331bbee8a25e2f0b31f1b9d3935a8aa0c693ad.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 6363⤵
- Program crash
PID:2236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1600 -ip 16001⤵PID:4740