Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27/05/2024, 01:40
General
-
Target
777ef6894e820bba6cd3f4d2f81282cb_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
777ef6894e820bba6cd3f4d2f81282cb
-
SHA1
cd4893c41615b03101c95170687731f5f8ef87e1
-
SHA256
682acb2e8fbae0a220ee3c38f5895a1e565242f9b79eb576f6d6ce530934bc34
-
SHA512
ad0078555615ff2a55da4357167771ba3ace8905f865023e6634e28408e6636ef00c91a87cb37ca331f4ad6a1cf396b0530f3f6852fe8f9afafa2c5919ade9ff
-
SSDEEP
24576:JVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:JV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\777ef6894e820bba6cd3f4d2f81282cb_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\HqS\Dxpserver.exeC:\Users\Admin\AppData\Local\HqS\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\gK9YR\ComputerDefaults.exeC:\Users\Admin\AppData\Local\gK9YR\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\7t32sGhC\rdpinit.exeC:\Users\Admin\AppData\Local\7t32sGhC\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a99b1c7218c122f2c2c7680311543ed0
SHA15e586a1aed7acfe1dd65c899b8fc8389d602b48d
SHA256acdd419705396f4184e27e2fa1059d6c9c8dc6d15b83904f0389eb23531cbf8c
SHA51291b82772c2ad5f1c0b5dfb82cdc7d461aba7e98d88e962db3d94420be1064eea765e35e214d45ec3ad3abe225b0997e9f7b40e6efd0cf95ee4971d9bbb63c00f
-
Filesize
1.2MB
MD5f3f6413c525f32e5b49f396570293e04
SHA1dafd1ea523193617e51720cde25884e7421640f7
SHA25631c638594cea5ba0430a19e933c6a05af8bbb866759dede602b9bf02afc8c14b
SHA512515ae44dc930b368b656b39fb931e7fac38ec2f55a3bd2c3a58b135a3949a62927aba1b67efd679c29480f12d0b8d979981fab7e377174a70c803f710172f885
-
Filesize
1.2MB
MD5cdef95d9120e61256b41a1687ec6daf0
SHA13ca4d0f0938e005f44bddd7103bf022918360e77
SHA256df3e72c0f272d0642b9cd3b76aac8eab0fd5d6a121ebe9068ebcc472823d5176
SHA5122196366e5957603a62b568edf97b995243a7e918d39f906550aa27df025b12712538fec908f2054088d4e81af2621f4062b127274752f2f403916a26e663144f
-
Filesize
1KB
MD54b12a55605af2dcd9b5d2c2bbc1bd72c
SHA146c740ea9adbd3bd6f83b8a58b92b5cfafa69a94
SHA256497af00575b69856f5cfcb336ce7f0c57df149cc145c9b2a6b0fa8939df2d73c
SHA51296b1805c29a016826b83be1e44b128bb1be8dc56edc7f9ebc4cb897dc43cb1c3e5ac861d609c25dae32a629bed44df26e465588685abb09c440bc829f855635e
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB