Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 05:31
General
-
Target
2bbced116fdb8fc62616ebecff5923b0_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
2bbced116fdb8fc62616ebecff5923b0
-
SHA1
08c7486f88a21923f42b1da93f80e518be7e2332
-
SHA256
c946e2a27a0c8eb2dd4bbffd200e12eb98ecec7ac2b41ae21b86ce6197e2444b
-
SHA512
e581584c16497af995212caf6f80011fdded57e02184293ff9d67c07d552a96e70655af54d1be9f28f12445f43ae578480c400d559528622e5e060e3c1b361d4
-
SSDEEP
12288:qVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:3fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2bbced116fdb8fc62616ebecff5923b0_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\kFbF6\bdeunlock.exeC:\Users\Admin\AppData\Local\kFbF6\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\OD0hrIG\DWWIN.EXEC:\Users\Admin\AppData\Local\OD0hrIG\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\TXL\wscript.exeC:\Users\Admin\AppData\Local\TXL\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5d33b63d2fed0bed30a7de7da7f334f50
SHA172c2856979e85767ac810c0e56034f58b2c9c74e
SHA25682fb7f267483e8115ed3eb7903944144bf69eb6e116588585b139df69dc3fc3e
SHA512a9726867311e596c5abbb6fa34ad4fac5fb35f1bf86fd19c02c24b7f90ed942aebe9204b1ccde810532f8b812c8bbe3a9b13dee571df854c303dc06faeef866e
-
Filesize
1.2MB
MD5925014fdc0fb8572907631e1f89c8ac1
SHA1bdba6311621bc50612627d34b5364017d09dc905
SHA2564613849fcfda8c4114f049c19f72efca388b24522546546f564dc9502b30c24f
SHA5123f6d920b302f03704c1d5729655cdbe22ae2904946a32d002cc16222b1ee5fb0ee6c2e15bf050e6c957db4557d30e3db96e4700466c932190c04df0fafd6ab0d
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1.4MB
MD5afd3721a5638a81a2a2232d0f961026e
SHA1b97f4eb73f7831acdddbd0fca39648d22abcf002
SHA256f644e5f2b8ffa813192354eb880f6017ae7786ab69f3e2b3c2f01ca9cd962773
SHA512662082680bc0a8a4479e2afced82e0b47c2f1bfa759203437b1b0a5d02075dbd83ee5d292dde6abaea50e7b01953b808f4b21405c9c962057bd59e12415b1461
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
974B
MD5760f1fd94a9242a1c74e00d0fc8c096a
SHA19f524814c50dadb2a3bf8e621f3ab191504d5c67
SHA2569c9e8f430d4395e34d1e3dcc8840222cfab00363fac4182711e6f0ee28f11254
SHA512c231448733329e341ca339d9bab954a29c6c6b71e4800cc6fcd10bd43e6477290189fe6763420222179c1c81364b1d71c63c4086e8c5ae973a3378652071fcdb
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB