Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
128c0d0800f9ddc1fc1ad2adbfe2af4c
-
SHA1
9eec1f0a49a705b50defa8855671e6265890992c
-
SHA256
ec2deee820615d16428c4fa1b4d150ec6ed62fa45a11ef64f174fa297d3ad00d
-
SHA512
64a7ffea8fc75775f5a72584a720606e71e3d5166fa25185ce4bc39d11e001d4fe9a54734933efa275ca770e8a3ebab1d6ed88f8eb1f9130db15e82d24538e4f
-
SSDEEP
24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1244-5-0x00000000024C0000-0x00000000024C1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 2676 SystemPropertiesProtection.exe 2508 winlogon.exe 2880 mstsc.exe -
Loads dropped DLL 7 IoCs
pid Process 1244 Process not Found 2676 SystemPropertiesProtection.exe 1244 Process not Found 2508 winlogon.exe 1244 Process not Found 2880 mstsc.exe 1244 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qiarkhdaw = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\JgCGiKiV\\winlogon.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winlogon.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstsc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SystemPropertiesProtection.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 712 rundll32.exe 712 rundll32.exe 712 rundll32.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1244 wrote to memory of 3028 1244 Process not Found 30 PID 1244 wrote to memory of 3028 1244 Process not Found 30 PID 1244 wrote to memory of 3028 1244 Process not Found 30 PID 1244 wrote to memory of 2676 1244 Process not Found 31 PID 1244 wrote to memory of 2676 1244 Process not Found 31 PID 1244 wrote to memory of 2676 1244 Process not Found 31 PID 1244 wrote to memory of 964 1244 Process not Found 32 PID 1244 wrote to memory of 964 1244 Process not Found 32 PID 1244 wrote to memory of 964 1244 Process not Found 32 PID 1244 wrote to memory of 2508 1244 Process not Found 33 PID 1244 wrote to memory of 2508 1244 Process not Found 33 PID 1244 wrote to memory of 2508 1244 Process not Found 33 PID 1244 wrote to memory of 1980 1244 Process not Found 34 PID 1244 wrote to memory of 1980 1244 Process not Found 34 PID 1244 wrote to memory of 1980 1244 Process not Found 34 PID 1244 wrote to memory of 2880 1244 Process not Found 35 PID 1244 wrote to memory of 2880 1244 Process not Found 35 PID 1244 wrote to memory of 2880 1244 Process not Found 35 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\128c0d0800f9ddc1fc1ad2adbfe2af4c_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:712
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵PID:3028
-
C:\Users\Admin\AppData\Local\ACtx1\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\ACtx1\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2676
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵PID:964
-
C:\Users\Admin\AppData\Local\6rI0wV\winlogon.exeC:\Users\Admin\AppData\Local\6rI0wV\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2508
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵PID:1980
-
C:\Users\Admin\AppData\Local\CTDHVZD\mstsc.exeC:\Users\Admin\AppData\Local\CTDHVZD\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d75c16f82958107ffb4530201c7e3abd
SHA1134badec71d54bb8839656f397a6273adbd9373e
SHA25606f53044e163ae6a2cb442cfe8cd8f4fbe296a8a2d0f70578735debc1a691c69
SHA512564bee64e3a34ea5a733e56fead628446b96858d4cd10d31b97452dbf538853e88b12e080593688720796cbf5b5d13dbd2b162b500a184a70e8d6e7fee9ab5d0
-
Filesize
1.2MB
MD5bc0a5d65fefb3be48900809fe268a272
SHA1628262999a0f992dc436abf97ce7f00b5a01681e
SHA2566b1043828fd26360b2154fed433ca45433cca399bb4e536f14954dfb22aa55a0
SHA51284b61bd808d8385fa83b3ed6859b8030f7691af765242b06ff4dab4436cfc04d78f07bf58f591270a38eec75995ebec38aca629b62db23e4d3a954b29fc5e01f
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
1KB
MD5d954dd4176968bee4bff00f285b22f7d
SHA18feb50d3e454eb4e5c1a3b10ae6d3fa4153ae117
SHA2563f466524487303f73a93893cc6bb35b00eab1456eb7f90370d127a3b40ff8b4b
SHA512be4e779035bb3058e99546e2f063cb9d6ccb87b68def4e8dc504e52e77e26aad3f23bf038ed2ee512eca8b4d6c8fdf53aae3b561e7235f7c79aca002943524fd
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
1.2MB
MD54fb0a8c5e119b61541115ea3d8ebb664
SHA13788ab79176c40aded1a79fecf4077e15d20264e
SHA256dc51ca5586432cfa365b3d05c307cc12e9c0b80c6d25aeb699ade07e9d0ec48e
SHA5126a2be037a8feaed06f4709d80075c388b9bd36ac5a35e45ee7d468536aaadb789d343a9d4189d3c93f29d4550a12d7ca0bbd73f14db616384d80e02d8a7bfd35