Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/06/2024, 21:38
General
-
Target
b0386ba950a1b343ae0b01e8c98e0a4c_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
b0386ba950a1b343ae0b01e8c98e0a4c
-
SHA1
5f2cca191a83203b55710072c5cef194bdfc7b83
-
SHA256
80945307d35592bafc62a4521f865dccdee21e442dc15d533675207d6c012614
-
SHA512
088224073d06521d9c43ecea1b493d12bb39ffa3f40db879c0b69c462a621db343cf7c03740304e063158b18d41ab747ecd99980c865068abcb8ced2125eda5c
-
SSDEEP
24576:4uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NP:I9cKrUqZWLAcUH
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b0386ba950a1b343ae0b01e8c98e0a4c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\AB0\SysResetErr.exeC:\Users\Admin\AppData\Local\AB0\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\FFzd012uj\rdpclip.exeC:\Users\Admin\AppData\Local\FFzd012uj\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\7xmqnl\sethc.exeC:\Users\Admin\AppData\Local\7xmqnl\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5245409dfc447b77520336c8252b2012e
SHA17f8fb399c14876f6b0644825a030005644a0fa9f
SHA256b81b76e6d70439cad03d1a357c84f021d2ca27b563ad7831626812a80b7c8e62
SHA512788516a14dae692e087cefb18b512c6c1b7c68326f555760ebdd6a7c29e38c35c8dc84163cc84ebc424e9a58eca52324f9045fae98005f84e753ffc779a86cf6
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1.7MB
MD54b1cbfe3639482825f57ac2e955bbc8f
SHA1c0f69986e33c39d5914d28f5d6731a37fc795ed9
SHA2566f8b78ea572014ce5e6a2d666b9bfffccb30f5f39c0ea488b4a440b0f616d27c
SHA51236fe7aff76793b2f1ca36145a335a78fc96495613ed16d3207f47188f18b734cab77614f5426073aa5cd03b6b02e410e1b93a265e6d1e0b61b7b9a7aa04b8d0d
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1.4MB
MD584969a4330ff6bc147535cd879588215
SHA12f08a07e756e6a7a12c0d581e01c3d5e25d520a8
SHA256124af552359d01f72355c347e8d4d60901359b8a98c1cca087806337e8dde1eb
SHA512d27a4a6fa92e82813ee81408e2f4fb46fd208d5621948b5f1f1c54da4fb7d92daa5350d0b85a85904480fa1a67c519cfa25367e4aba2f519d9f0de6581169ffb
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD54e8177e72653790e439104fcb6ec0d60
SHA1f5da707f630441fd7d062b7818023005a3d0deef
SHA2564c5a8b6fc66fd7c17149a398442a1f52f6f2e1eb45f0e065d67e911d8d20af55
SHA512cfde9e9fb771734528c0672087f3f16565b89dfdeef270de9a31d1ce84ac1815e5b027bc202f794e06dc627f058293b0b9a61cc587d31496ef7e3dc1c627eae5
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB