Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
128c0d0800f9ddc1fc1ad2adbfe2af4c
-
SHA1
9eec1f0a49a705b50defa8855671e6265890992c
-
SHA256
ec2deee820615d16428c4fa1b4d150ec6ed62fa45a11ef64f174fa297d3ad00d
-
SHA512
64a7ffea8fc75775f5a72584a720606e71e3d5166fa25185ce4bc39d11e001d4fe9a54734933efa275ca770e8a3ebab1d6ed88f8eb1f9130db15e82d24538e4f
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3412-4-0x0000000002A90000-0x0000000002A91000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 4760 WFS.exe 1860 SndVol.exe 4416 eudcedit.exe -
Loads dropped DLL 3 IoCs
pid Process 4760 WFS.exe 1860 SndVol.exe 4416 eudcedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ahvkwrxhngjqh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\u2uSfP\\SndVol.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SndVol.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eudcedit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WFS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 rundll32.exe 3000 rundll32.exe 3000 rundll32.exe 3000 rundll32.exe 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found 3412 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1032 3412 Process not Found 84 PID 3412 wrote to memory of 1032 3412 Process not Found 84 PID 3412 wrote to memory of 4760 3412 Process not Found 85 PID 3412 wrote to memory of 4760 3412 Process not Found 85 PID 3412 wrote to memory of 2852 3412 Process not Found 86 PID 3412 wrote to memory of 2852 3412 Process not Found 86 PID 3412 wrote to memory of 1860 3412 Process not Found 87 PID 3412 wrote to memory of 1860 3412 Process not Found 87 PID 3412 wrote to memory of 4484 3412 Process not Found 88 PID 3412 wrote to memory of 4484 3412 Process not Found 88 PID 3412 wrote to memory of 4416 3412 Process not Found 89 PID 3412 wrote to memory of 4416 3412 Process not Found 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵PID:1032
-
C:\Users\Admin\AppData\Local\ybCsi\WFS.exeC:\Users\Admin\AppData\Local\ybCsi\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4760
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵PID:2852
-
C:\Users\Admin\AppData\Local\kEIM9N\SndVol.exeC:\Users\Admin\AppData\Local\kEIM9N\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1860
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵PID:4484
-
C:\Users\Admin\AppData\Local\7VrA9P\eudcedit.exeC:\Users\Admin\AppData\Local\7VrA9P\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c1748fca0640ddc45793711b172902f6
SHA197c50b908de286fdff7f2b3fab67d33a3a67c6b6
SHA256e9809ad62a7b9c76b6ba64fe3cca56a5a64971c3508fdcb4b34596b0c18a59bd
SHA51242524f5716ff7d9bdc63caadf302e2a675aacd8dd5e9fb66c88e18c5107106920e652195f2ebc3553b98b3774399b2d583c42a399954bd70cf3090bb46af1491
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.2MB
MD5e778fbadc9fb2380a5494b8ed1ba79d4
SHA1e67c2101d1554d1ea91c3906abf99b474f7857cb
SHA256533af40a7889220680a8c2ce1532342a7b50f41a999abbd68681f92993b7ec52
SHA5122ffff189b19dd5d93308b3c4e139f6fcbe25689b153f6d02c96afbc08597347d1af1b54a84d5cec2e94a7280a2c81edd9ed8315eceb973561fe67d570f03204d
-
Filesize
1.2MB
MD58eb42e61528ee0cab6a6990d63871eb8
SHA19fcfaad8f5e9a03e813e36098215b103a990194d
SHA25625d9f9ce4e81cac526229e47b6ba53b60ab79f596728e16b80beb20e293961a2
SHA5124d7a96932cdb5dc7fafe7b32196f7b8c357995a5b99165b041574d457e8405cbc8501d651dc7761555a9c1d363038eaf4429450d39821fb870e068fea2cc4142
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
1KB
MD5d6ef9e4aabf88c2762550820357dbcf6
SHA13a4a2726135737d7fa1af99467c89a167150e269
SHA256c9353aa9628eebbce7ef1f16309a500e73eec4bcca5b46e9028f1ff420f48036
SHA512b8cbe8ac0adb61e4f90505b68cbec7724c7c3be8bc2ad7df3e838d6ce0ef3b106b5feb84074ab8bd933c2b6432a4548b362353bf463370be641f52db21420be7