Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28/07/2024, 10:35
General
-
Target
14fff56abaf6a088651764782bc59549_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
14fff56abaf6a088651764782bc59549
-
SHA1
b8df62e709c9c42ff241448557973c8f7fca43cb
-
SHA256
caa4ce651ab88ad9a49b05e59df3065f8488b9051b3195849775dc29e83957b6
-
SHA512
c59177fba64d6c286b1d74af945ffd73b55cd6734b194803862534337c9e838131ede5d5f59c9834cfeebf5b399f281a7af91eebf43b779d730821aef5d37d62
-
SSDEEP
24576:fuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:h9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14fff56abaf6a088651764782bc59549_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\UPj4\tcmsetup.exeC:\Users\Admin\AppData\Local\UPj4\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\AoS5\calc.exeC:\Users\Admin\AppData\Local\AoS5\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\aSZNdGjc\spreview.exeC:\Users\Admin\AppData\Local\aSZNdGjc\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5fffb45cf10a73894f87023d8d320b0cf
SHA182668a4655e2485d48656a51ec98d0b17d854032
SHA25631962ae9cb4b00bb8e99f75c2716cb2e4f25747a267e95b5f0a28874036ab68e
SHA512564162980dab3980a4342dc01a346086cb7e9ac9605890f743a1117865b3d5e73065937018eba90f854cbcf895a523cd38136428a32c588d75345a6ec9ecec96
-
Filesize
1.2MB
MD559a8ef04253b9f4b6a136efb71af4df9
SHA1f61422aea761db062b4808c1caa850c215bfe041
SHA256f6842748552e61b6b685f1ef3b8f0b984ba1eff8f700fff478b9fa0ad0f9fb73
SHA5126b714cc7c18b3885296e85c3b6d8f0cd9848d117e8ef5e6d9b0c0103c27978e63ff78d7e5462a00f117b9771fbcf339372eee348d8d2196f434f1039525c1c8f
-
Filesize
1.2MB
MD5854e53d1d9bc3f02e34ba2b177ba4e5d
SHA1d96ac4eb4c8618bb21f5842d7fb839fba1a7afcb
SHA256546aba32532428d428e25c407cb79a23bb53d582709371fbb79b0436474ccd41
SHA5125cd9fc2660db715749982f2b760232fe9c786d56891e90363c2aa0727e5fcfdfcb6e3d46dbf4adb505608e3edc7f88c2d8b6a03ec968803d1dff7ec85a91447c
-
Filesize
1KB
MD517ef37d0358805766b6bf302188587d8
SHA18a2812f5c700a943664a94716010eaad5a95eb19
SHA25640b14e9b0c161c6bff9b3c4910b64980cc3afe1a3bf777d3d3a296419ea5e36b
SHA512b3d41391cfb9d1a20edaafd8b3c73a7bc46749db084752a5c4d30fd547bfa7ff096a4606235deee7328dc869321fca03066980dfdaee3ddc2e4a3d2267256382
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB