Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28/07/2024, 09:27
General
-
Target
128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
128c0d0800f9ddc1fc1ad2adbfe2af4c
-
SHA1
9eec1f0a49a705b50defa8855671e6265890992c
-
SHA256
ec2deee820615d16428c4fa1b4d150ec6ed62fa45a11ef64f174fa297d3ad00d
-
SHA512
64a7ffea8fc75775f5a72584a720606e71e3d5166fa25185ce4bc39d11e001d4fe9a54734933efa275ca770e8a3ebab1d6ed88f8eb1f9130db15e82d24538e4f
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\ybCsi\WFS.exeC:\Users\Admin\AppData\Local\ybCsi\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\kEIM9N\SndVol.exeC:\Users\Admin\AppData\Local\kEIM9N\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\7VrA9P\eudcedit.exeC:\Users\Admin\AppData\Local\7VrA9P\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c1748fca0640ddc45793711b172902f6
SHA197c50b908de286fdff7f2b3fab67d33a3a67c6b6
SHA256e9809ad62a7b9c76b6ba64fe3cca56a5a64971c3508fdcb4b34596b0c18a59bd
SHA51242524f5716ff7d9bdc63caadf302e2a675aacd8dd5e9fb66c88e18c5107106920e652195f2ebc3553b98b3774399b2d583c42a399954bd70cf3090bb46af1491
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.2MB
MD5e778fbadc9fb2380a5494b8ed1ba79d4
SHA1e67c2101d1554d1ea91c3906abf99b474f7857cb
SHA256533af40a7889220680a8c2ce1532342a7b50f41a999abbd68681f92993b7ec52
SHA5122ffff189b19dd5d93308b3c4e139f6fcbe25689b153f6d02c96afbc08597347d1af1b54a84d5cec2e94a7280a2c81edd9ed8315eceb973561fe67d570f03204d
-
Filesize
1.2MB
MD58eb42e61528ee0cab6a6990d63871eb8
SHA19fcfaad8f5e9a03e813e36098215b103a990194d
SHA25625d9f9ce4e81cac526229e47b6ba53b60ab79f596728e16b80beb20e293961a2
SHA5124d7a96932cdb5dc7fafe7b32196f7b8c357995a5b99165b041574d457e8405cbc8501d651dc7761555a9c1d363038eaf4429450d39821fb870e068fea2cc4142
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
1KB
MD5d6ef9e4aabf88c2762550820357dbcf6
SHA13a4a2726135737d7fa1af99467c89a167150e269
SHA256c9353aa9628eebbce7ef1f16309a500e73eec4bcca5b46e9028f1ff420f48036
SHA512b8cbe8ac0adb61e4f90505b68cbec7724c7c3be8bc2ad7df3e838d6ce0ef3b106b5feb84074ab8bd933c2b6432a4548b362353bf463370be641f52db21420be7
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB