Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 15:02
General
-
Target
c90f1183641a387ea5575b5e9cfc3823_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c90f1183641a387ea5575b5e9cfc3823
-
SHA1
7f54137d178f58adab7e50adaf3c2d48dc5b4607
-
SHA256
849f991381c28c420499f0dd6871940f7074637575f5dc3c6e5826962c87351d
-
SHA512
977c1b03b575156862324347ba97d88f8dc3fdd46ef1b6b7e7e6ba933cd22151af2609e87ff13e9655b131b839ca8efd67aa9406e9d34e2cded8e51b6676938b
-
SSDEEP
24576:uuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N2:O9cKrUqZWLAcUO
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c90f1183641a387ea5575b5e9cfc3823_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\d03a1YLY7\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\d03a1YLY7\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\jJj\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\jJj\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\C7twDpkh\CustomShellHost.exeC:\Users\Admin\AppData\Local\C7twDpkh\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
1.2MB
MD51260b56302eb91f7af2ec5952839d12e
SHA1bae23081e1a23c2069afb6c35b1a50f6acb2c9e1
SHA2567a97c8f5af7066241a1a50d5e787471d152d2f6963eac438d67fa50dd4894bbc
SHA5124e8f0528964f731fc927e106309829fcf21fdfd65847cf59d96aa164333194663a2265d4640ca4d50769a01e976c9159f4106ba938f28776c21a89c38f32d246
-
Filesize
1.4MB
MD504135c192e7d85ba140418bf10e929cf
SHA190c99c43b3afd6fdc876f94b1114fe366119f5cd
SHA2566f9f8e8d661f87b3a9d90201ed2740fe5bd09088e76fc708eb54424e31c3b9f3
SHA5127de5f279a1a9165755acbb4f2797aec9e735d43aca52d2aa2cb6cc9c314cf2bc5c14abd663bdccc960a015c5f6fc1dc6c2e900ddf1191ee2f3970c21026ad8df
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
1.2MB
MD53e77f1d18c80393141af62c31014c49c
SHA13a89eba6128cf237f34be498bf878f129a4806a6
SHA25680e0f2698d72ca47fb0d39e016ae96253f68f99bdd832e10ad109d5b62b42edd
SHA512d5323dbfe4384e4052474df4ca311b4616fee6f9b4df6b27d50bbc68930b872f88889eda19de85239d138cacf63f8d7ec20084070eacd59ac635b40d53307393
-
Filesize
1KB
MD5fb584ba2987b40fa062ab8e864282ea6
SHA154aa4a0425dbf71e4ce0e8929fd5bf7d23f9b0c0
SHA256feddcf2c67f111ae869c2748871557752a111bbcc6f02ce25b87e1e94b242de8
SHA5127584b90fdd3d7389c1e38a5647defab71f4b33897c16c37c532050afc2d9633acb77845410a1ac1cd1ad5ce17b589e5daee85322e92ad811fc03f6866ea9e34a
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB