Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
28/07/2024, 10:40
General
-
Target
15316c0e7c8c689c67f3bef4cec0c488_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
15316c0e7c8c689c67f3bef4cec0c488
-
SHA1
51e5cbc2766b3688c11533cb0cdb5796464c248d
-
SHA256
4107c69a51675b589d7d1b9b32b7c3f4f245f25509538e8d546f5ceea0353aad
-
SHA512
404c00a4274ff305cb7e12acde5115d91186fc5be83e1113824234a34541ef54102983a3f944377bae94ff20002d52d4772764674d9ac6d4c73f000ec96a03ce
-
SSDEEP
24576:UuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N1e:M9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\15316c0e7c8c689c67f3bef4cec0c488_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\rSjnFQgFB\rdpshell.exeC:\Users\Admin\AppData\Local\rSjnFQgFB\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\XbHIVr\mfpmp.exeC:\Users\Admin\AppData\Local\XbHIVr\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\FoOkj\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\FoOkj\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.5MB
MD5d4627eeec972cac108a444e7734ff4d5
SHA1c302dbace47aa4d0ca5f716d442ea9082fb9604d
SHA2560337d99c1cf6a950ba11d24afb3fe81300e69a78d9e7026fd0d7f00ef78de293
SHA51203b2c3a1c2ff63d82f62784dd8ada180fa46a34f6818f666bff7b9487072c078168b9b2936ecbdd46752feda3ac7c463fa51b2545205aa0bfc59c9b64687d4fb
-
Filesize
1.2MB
MD5d146eb73696b5a407ec3efe7d9c1760b
SHA100be95be22f24184e7a32a2db554d2886fe4c011
SHA25660bbd9c61f10009de4345cd7b1f3ce69c28e3fca5989beffcf7c96c79fb24289
SHA51245310da444c4adc4873f20274a131846e25cace6a55c5adca8ac992fa974235476d672adb7aa76ec09f4b3a2f8785e63cd51446a97c8c7179873118e78303e8e
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
1.2MB
MD5e9bd462e67a4f3cad3b89716b96ec689
SHA1a2bbad2731d8ef43a8d7284033690d64f25b4943
SHA2560e5980c82e93d44123c301794fce073433c426b5a6c9e87bf36c991a30c3abfe
SHA512fa33dc7ee076e507eb817850777969dad7c8371a2f89f049f6c90472db30c64758e0acdaae384e69240c98159d1e26592045f1fd97fd43c089c9290fa409f08b
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1KB
MD5583ccdc061e522a184cedfddc08d6ff5
SHA117756e949583d69cfe45c71321ebc81493279ac7
SHA2562a843287e755aef43347896c9a95bd863d6654c83210a3db5718c103d70707fc
SHA5127899995d363a298f40fbebd032150628532b74d9abee1e1ef65e650b131d5a7dc4478035aca368c8d099819ce1b161367b9f7f4517c4d1fc4c09d5b0fe0f0bd0
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB