Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28/07/2024, 10:40
General
-
Target
15316c0e7c8c689c67f3bef4cec0c488_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
15316c0e7c8c689c67f3bef4cec0c488
-
SHA1
51e5cbc2766b3688c11533cb0cdb5796464c248d
-
SHA256
4107c69a51675b589d7d1b9b32b7c3f4f245f25509538e8d546f5ceea0353aad
-
SHA512
404c00a4274ff305cb7e12acde5115d91186fc5be83e1113824234a34541ef54102983a3f944377bae94ff20002d52d4772764674d9ac6d4c73f000ec96a03ce
-
SSDEEP
24576:UuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N1e:M9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\15316c0e7c8c689c67f3bef4cec0c488_JaffaCakes118.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\e6kH\unregmp2.exeC:\Users\Admin\AppData\Local\e6kH\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\tRF5Q\Dxpserver.exeC:\Users\Admin\AppData\Local\tRF5Q\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\fsdj\DisplaySwitch.exeC:\Users\Admin\AppData\Local\fsdj\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD538efc35fe134cb45ef094cfb58e970d0
SHA14d0053912ab12cbc3d6cbed6f1244b1b95961f30
SHA25671dd0635e518b535bd7285c91349f4b74f6a1b5fef0fbe397e40a6da48faf607
SHA512d02b20f126f219a9a71251b0a0db86081f96a9be649c078b04ac141027e56b5adcfd71d080105f271d3e3fd84e38cbfb490a48822a099c29723eb23d357fe091
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
1.2MB
MD5c6ca03d8712e330be94fe2b1206d2678
SHA153ddc52b266da39b50fd065861caae2b993ecee7
SHA2568ba4e3d41c06547e75ce46160088e39a62c91b9a3d7721878ceabf33df8392f0
SHA51235e2f0ebbb6a8d1c2492ecf7202c48a5cb643c5bf55b4a56d88b3c2d230d8f74fcfa3e072784937080b9d7efc3b11e178dd1d6433ff095f34e3eb4ff6751a2a5
-
Filesize
1.2MB
MD50de4c55cf4379ef7d7aa60da895ad6ba
SHA101fa04b94c839b1d5c56f018109b80da98c48f86
SHA256b926cd9233f7f6dfd845a957b2958d3bdb2466a93780790e0f54fe292cdbbb33
SHA512cd0a37541bf1a81a0bb1115a4cd2a4db741efa4065f462ff7958c3e1ab9b279c2539c99acef21efea38d160157992431df0fbe83d049ee1cbd51236d8fe0925a
-
Filesize
1KB
MD548381d922e40606a8a08440f56ca263b
SHA15dfcb183519c48a8548ee9e9f6919c490763bfd7
SHA256801da5fa9721f26bb0eb0d0c41bc8887cf175e5a6b4bff7b0658867fb0f202c7
SHA51226f4264d2e7554302847d3001f4503b030638f6607fa0b8125f616cb7e82b2197c1bf50f6bacaf75102f420b6060a4c2e59b3d52560e06d4ba7b04883ea659b3
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB