Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
-
submitted
29/07/2024, 02:35
General
-
Target
33a896d6184851ee490f07f6ef499b73_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
33a896d6184851ee490f07f6ef499b73
-
SHA1
fa9db1c9c6256ae0dbbb02593ca853df3f31f171
-
SHA256
184451839f912dfa47548af44b5f0c8a62e084a23abe992b3cd301208c190823
-
SHA512
1140bde17fe9f76a65b51960526d6d0b2db68a031c1e55689ce2369406f1436f3028f7154119b154516a576a3298ff7efd8e8d46af491647cd0c4e2f88d8319e
-
SSDEEP
24576:3uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:59cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33a896d6184851ee490f07f6ef499b73_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\z9fTl7V0\Magnify.exeC:\Users\Admin\AppData\Local\z9fTl7V0\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\rUUA6F\SndVol.exeC:\Users\Admin\AppData\Local\rUUA6F\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\0ADcrcCw\EhStorAuthn.exeC:\Users\Admin\AppData\Local\0ADcrcCw\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.2MB
MD5ef952c881b74c7b3cb9ec41d8981cc49
SHA12d7c92a5401b121344844d5cae5d3e3f4648b9ad
SHA2569e2266a9911fe9e66ff5bac009aa73c92fc56601f0dc2a6b567ca2004c632448
SHA512cd17a41e68b032e352ddf146c5f17b1641428109887745d437716dc3a6a6e05b1ef37947a579d9ebec7d649d8106b73665963fb253388c4d3c6da7cb5a7ab6fc
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.2MB
MD5567888dd6f6438391442c336b69c1de1
SHA15d8002f96edef86690a87d7a027a27c9cbd23308
SHA256ea16a7187550c9d8a63a773810bdb4aedfa5dc02472990ff33e4a738edd29214
SHA512d346e9893890dc9ce2619dc7eabdf49f8ff2a576e4cf3215c4406f5714aced06582d6d3544ccbd0b7f22b06651b288cf6607dbab6e82964f2707f77d109a5c01
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
1.2MB
MD5178eb82d699490dbbd86b903dcc0780c
SHA1d3052c25526e9888fcb773c0e322b94bfb0fbe9d
SHA25673af5c1ebbadf49a9f891c5601008b46dc67a4103e337a6b2b8c17d90b1d4cf5
SHA51208a992287c08c56e6e95a60d7bd5641905b1af12bdcdd7eeaaafd38b8a604cbd052e1a042b3aef625a60a1bb648cfa3b21d818b4b08b4624361756518f5b58e4
-
Filesize
1KB
MD5fe0678142ec73807c831fd16b75e6f0b
SHA1e898a8c0e93042712aad6d612bdbe783c2edfd8b
SHA256f9e6b595bc5211d3cf1ebed189b75bd3fcfd695b4fda7f6b37d879896feb053c
SHA5127d6df1ef1b857dcd38bcc0dd626d541218cf0aa254a64892a06832febeac02d0fd6511c9f6c640bd19b57bf04fad4451b1b64adccbe2d9e1661a8a49cec222d2
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB