Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 17:29

General

  • Target

    JaffaCakes118_00154434332a46af8959363aa16ee90a501c58650e60ae52388def7bbbcf53d0.exe

  • Size

    1.4MB

  • MD5

    7b66a391939cfa465d2db7897ae0e20b

  • SHA1

    8252293b812b2dd3e527a58e91cc5b88aa62bf45

  • SHA256

    00154434332a46af8959363aa16ee90a501c58650e60ae52388def7bbbcf53d0

  • SHA512

    239dc6519594a139b8593b8692f6cc20d296a48d1b0b9b3f19204aebbba3bc5f184c3c4b7010200ca58df4c1e18800ff1b6d186bff5f815da4b25fe684b66ac6

  • SSDEEP

    24576:7BoExs0XhBGCopzDbaYSPetemk94W0v+N/ZzvDrSZgMngUlub1hksvEjIa7EI:7BZrw9pzD+Petemk9T0mN/ZvSdlloksZ

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Danabot family
  • Blocklisted process makes network request 6 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_00154434332a46af8959363aa16ee90a501c58650e60ae52388def7bbbcf53d0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_00154434332a46af8959363aa16ee90a501c58650e60ae52388def7bbbcf53d0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:772
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • System Location Discovery: System Language Discovery
        PID:3224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 640
        2⤵
        • Program crash
        PID:2968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 716
        2⤵
        • Program crash
        PID:4844
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1996
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4a0
      1⤵
        PID:4452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2408 -ip 2408
        1⤵
          PID:2036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2408 -ip 2408
          1⤵
            PID:3588

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2408-1-0x00000000025C0000-0x00000000026EB000-memory.dmp

            Filesize

            1.2MB

          • memory/2408-2-0x00000000026F0000-0x00000000029CB000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-3-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-4-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-5-0x00000000025C0000-0x00000000026EB000-memory.dmp

            Filesize

            1.2MB

          • memory/2408-6-0x00000000026F0000-0x00000000029CB000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-12-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-13-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-15-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-14-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/2408-40-0x0000000000400000-0x00000000006E8000-memory.dmp

            Filesize

            2.9MB

          • memory/3224-31-0x0000000001360000-0x0000000001362000-memory.dmp

            Filesize

            8KB

          • memory/3224-25-0x0000000001300000-0x0000000001302000-memory.dmp

            Filesize

            8KB

          • memory/3224-20-0x00000000012A0000-0x00000000012A2000-memory.dmp

            Filesize

            8KB

          • memory/3224-37-0x00000000012C0000-0x00000000012C2000-memory.dmp

            Filesize

            8KB

          • memory/3224-36-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-35-0x00000000013A0000-0x00000000013A2000-memory.dmp

            Filesize

            8KB

          • memory/3224-34-0x0000000001390000-0x0000000001392000-memory.dmp

            Filesize

            8KB

          • memory/3224-33-0x0000000001380000-0x0000000001382000-memory.dmp

            Filesize

            8KB

          • memory/3224-32-0x0000000001370000-0x0000000001372000-memory.dmp

            Filesize

            8KB

          • memory/3224-17-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-30-0x0000000001350000-0x0000000001352000-memory.dmp

            Filesize

            8KB

          • memory/3224-29-0x0000000001340000-0x0000000001342000-memory.dmp

            Filesize

            8KB

          • memory/3224-28-0x0000000001330000-0x0000000001332000-memory.dmp

            Filesize

            8KB

          • memory/3224-27-0x0000000001320000-0x0000000001322000-memory.dmp

            Filesize

            8KB

          • memory/3224-26-0x0000000001310000-0x0000000001312000-memory.dmp

            Filesize

            8KB

          • memory/3224-19-0x0000000001290000-0x0000000001292000-memory.dmp

            Filesize

            8KB

          • memory/3224-24-0x00000000012F0000-0x00000000012F2000-memory.dmp

            Filesize

            8KB

          • memory/3224-23-0x00000000012E0000-0x00000000012E2000-memory.dmp

            Filesize

            8KB

          • memory/3224-22-0x00000000012D0000-0x00000000012D2000-memory.dmp

            Filesize

            8KB

          • memory/3224-21-0x00000000012B0000-0x00000000012B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-18-0x0000000001280000-0x0000000001282000-memory.dmp

            Filesize

            8KB

          • memory/3224-39-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-16-0x0000000001270000-0x0000000001272000-memory.dmp

            Filesize

            8KB

          • memory/3224-42-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-45-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-48-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-49-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-52-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-53-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-54-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB

          • memory/3224-56-0x00000000013B0000-0x00000000013B2000-memory.dmp

            Filesize

            8KB