Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28/07/2024, 10:17
General
-
Target
1452f13dc50be7b78017d4984f0b98c2_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
1452f13dc50be7b78017d4984f0b98c2
-
SHA1
df176b802a4a5c9d9bad302c5116b7688c219859
-
SHA256
3fd4e602beb3bc04479f55c761c27cb0ef1d8011db499266eb6615d75d53c067
-
SHA512
af5e290af613a833236deb680d3bff9be6cfc60a71f0581edc7b15351cf385c79d5053366e39597030334dc6a3d7a62f32cc01ace478b9640c4fa4fdc28e5d4b
-
SSDEEP
24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:a9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1452f13dc50be7b78017d4984f0b98c2_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\ThF\ie4uinit.exeC:\Users\Admin\AppData\Local\ThF\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\l2y\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\l2y\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\UQdYt\mfpmp.exeC:\Users\Admin\AppData\Local\UQdYt\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5950285ebb513b0a69c9fdb0887d9bef8
SHA15b2b3d8657c85602c40381f5a7abb4d5a8049bc6
SHA25693d06ab7ff633199f07bd6e5e77351e40311eff5aed53a4fb05b9bab067f99f1
SHA512073de0bf8b0f9f2aee3378565388ba74e2f44eb16b7a256a2658deab79e38d32fde50f57eb5fe723c40afdb52c1d87c6e291f14a3de2fb795c1dc9946ad753d6
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.2MB
MD5106b7860e5e5810731c5cb5101daab36
SHA1c1ccb2d688dfb2b1305e391b3b82af93c697516b
SHA256b6718a611552b043c0a66b0704e2c1ab70521869c2c8bd2fde175468be7a3ea3
SHA51237f4d956249ccc53ff5fc0ec166a72e31b609b77ba73161e0aa1b9a898af4cff1b0a1fb9600c51d6351f840115f5bef7a89017b502d0e0abce2d51af42dbf3cb
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
1.2MB
MD5e2004b52c67b5b25e3be808c2258effe
SHA1d244efa1eaa77c3f880c4358d0897b0c88e0cc6a
SHA2569f33fce72ed702771a9a25a8e8fd4f0615991cf441d772c732e0dd2feb93b296
SHA5127f98a08091ee0f9940ccb113aa35325001285888a9642004a802d0f9e1aa9a25fefd71458d08b5e430fad8cc540f0ef2065122722467680ca7d379e3ac59939c
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1KB
MD583a8b9f2772443cf868c132f6fad5eb7
SHA1e534bc93321d5f15259e270bf9e62706b2a3ce4a
SHA256d13c34a4a02dd8e3c0fc94203480c2e2b624ae2d73b19c4561f3fb2e258e4b7f
SHA5123c47c6bff9ed6fe45473ea738546ed53e13fb69b2b4c8129ec5ee326026880295202c3be97d7ae69660202fbf5a3829afe554e49666698974acb12a62f9191b4
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB