Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28/07/2024, 10:15
General
-
Target
144023104c70b0a9aa922598713dc3ff_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
144023104c70b0a9aa922598713dc3ff
-
SHA1
85f48200ea9ff6a73c6ae805a8f3533a1197431e
-
SHA256
1c96cd76a5127c8080f7a82d9d488dcb7914d8f412ae35a26c6ba45216e60d6c
-
SHA512
b6b501105c3411e120cc9786840248f7dfecc24325e8c74b6c2434f4340aa26a4925ee81faa9e3e64fe88e29c4b5bb7a5f3820ea9d0f7a829fa37e4ff6378069
-
SSDEEP
24576:LuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:V9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\144023104c70b0a9aa922598713dc3ff_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\XAd\SysResetErr.exeC:\Users\Admin\AppData\Local\XAd\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\NpTv\wbengine.exeC:\Users\Admin\AppData\Local\NpTv\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\T10GY\bdeunlock.exeC:\Users\Admin\AppData\Local\T10GY\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD543872d3fadd5352103287eeccd7e3135
SHA10fb707749805f7ceb259decb348de5ce4aa1eb4a
SHA256e11e03e6fb44a22ea265cdcd921f9f6e8e64d328d7d1585778d25b1c45cff9f9
SHA5120c62383e8f0eca483b25acd41647e9f529f9154fbb40ee92838a5d654f6ed666711f57dcbf173694f6677ba5041779a0766b4d1c5d1b04fab091c3178ac4bdf1
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.2MB
MD5a84d4c91e6ffaafb46a63d6df5b9e8e2
SHA10eced520d5e022330537b94c92c13dfe57a507d6
SHA2568a15863b04219f42f8d30036d43c6bc112a9383d82707264a2de33eaf94d7cb9
SHA512382f8f1a1ea138a8e2b25afc62bb19275718469b4fea48a517eb00ddd2ddadbebca61db4c7183c15394cd75334ac5e7492d5524e9ad753a35e887857ac0df4ff
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
1.4MB
MD5467b5d3f5e26401090a234480ad17783
SHA1c92e0c2b8658c9fc332dc566adc005cdd7cde5df
SHA2562c6283ee2c1a5f16d10eddb9110529fed71d25897342d8de5a137caa29ab01c2
SHA51207c01788df2d11290650ccbd903dece600035e93391a9a97c867f1eacea294101f5ad00c8da071b500925392e1ec5298dc6313f5d79abb4d3bdc1a11d2031b38
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1KB
MD54a4b87854569f016a54a43abe972b700
SHA1d01e4e272e2c080d058ce38a5f4c532c870ce3b7
SHA256590e38c48bedf82fa7e08f77442bfbf52c35bafb7685ecd002633b377321d890
SHA512a1f5d225d88bb3f53e5e336dfdad19018ec6929aaa9b218c72987570e3c418845002572d1b6f5eeba9b556877dcb1d358d12d3518f2293b51357e4ed724d8e2c
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB