Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30/08/2024, 08:51
General
-
Target
ca85c8ac9e78fff1382072443b979d98_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ca85c8ac9e78fff1382072443b979d98
-
SHA1
ac2624a13f968db008cec1aac51691778b98c743
-
SHA256
f493377faeb311a801726886346632f0cecb8f6a70547a01b69114192c3caa2a
-
SHA512
3a273ec1b7b3c81a163bc2a5b4082da83427eaa798c449e34b25f79ca6ea4e84d749f319321604b9871ab4a9dc94b960d0e69a02244b9a44f7544a65bbc9b764
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ca85c8ac9e78fff1382072443b979d98_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\uRQyG3u9T\sigverif.exeC:\Users\Admin\AppData\Local\uRQyG3u9T\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\Lk5t\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\Lk5t\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\madyi\RdpSa.exeC:\Users\Admin\AppData\Local\madyi\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD549f7c3397ef1fbc9307a8baa3025fbea
SHA1fef05e4f5ab98ced1f7ef701f296df882750831c
SHA256dfe98783bf583b18be0c492e95d0b9e151d075d78a2ee8c100426ab2117ef46c
SHA512d73ad109f9f7232676935a9496a3a558edf2e9cd6208b7ac33f9d07c04847ba80a39f1fce0e97afb17a9d9f62a0fd4497931f06b59bed13309e468badfbd492a
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
1.2MB
MD5d52be6ba03afad7b1c51a3b0a6804975
SHA1c1e65350ee1a32a9a2969bb2333c63eff0f3006a
SHA256fe4ad2a0e743df5d66486d4d1611f65a52485cde0b24da457054000892a24439
SHA512eebbf6c84de3d789ae784e4ad25f6e5eea851b2587d5ac4251975e6a35f073629d0bf60796db2dd65ec550fd01796a8d7826b7e2d02d952ee9aba11e49435c3f
-
Filesize
1.2MB
MD508c7f661ff863e617d5fd2ac73226268
SHA17a32c98a2001adf5ce3802a1b265d0a00d088ab4
SHA256dbc11644580df6f89d2199286dd61e6db69930033d4e3ec06ba7690b2c278faf
SHA512e187f3449ad11b57b51ef01aed2b8cd7db7799c99bf6f4696560d60c71541e829cc56eb9e03d22621296e7e43307efa3796ea0d03486ce99ba52a52b84290d38
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD5a19219225b4c2238c199168dff98c15b
SHA1afcf17be740b9e64691990e42dfb24eaa0faec08
SHA256863ee310e6174b82f95bd630d591d161c61c4ffe94bb494559014ded1f7f9722
SHA51265e20915b3a7f280b30004f9ec51e0d0eca52d3505bac43524338f28afe03d51723be3f69eadadc673772ba27440b5b32572bd6a765fecb4e07d29f8b35059d1
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB