Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20/08/2024, 04:41
General
-
Target
ade4242e8a6dc97b07a8721c32f1e24b_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
ade4242e8a6dc97b07a8721c32f1e24b
-
SHA1
9c9b2fd98d42b18fcf370261a1a333d5402491a1
-
SHA256
7c3d1d4eb81a4963b448e3c15635cde7559bcdb2fbec800bfd5f852e6c6d7711
-
SHA512
fdb6f2c28514da871fab214d9de9b7042dc966ff3967172648734c534c4577a7e67287c03498f5300783194152f30a56909daa8e84eaad19e580924f579ac079
-
SSDEEP
24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ade4242e8a6dc97b07a8721c32f1e24b_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\ioaPB\msconfig.exeC:\Users\Admin\AppData\Local\ioaPB\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\BTTkpN\notepad.exeC:\Users\Admin\AppData\Local\BTTkpN\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\EbD0Fxf\rekeywiz.exeC:\Users\Admin\AppData\Local\EbD0Fxf\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD54cbfe0955c07895ee50ba92de2df8967
SHA1805aafb69d6c91bf7635937537a19fafafd9e62e
SHA25604e44d7a1b236b59ee529de21b49a782f20c7e07e41fecdd930c3312e2824adb
SHA5126f5ce6059e8f4a6278697e632698a2b7d63206074626d8850fb998eab773a77031613d03b20b22c0b5dd48213c1bd5caa0be3e4609d4fee4cbc5ca89dcab6e91
-
Filesize
1.2MB
MD56ba9b573acba0a2c85d9414aa4a77d1c
SHA18e45e1a14541ae5f6bd4ca92a126718e92f089ed
SHA25642214cdfedbfc6bdbeb789efe7f920329d5f01051345e5686cda4c2dde77e536
SHA512be2deb6f57d38dca7e9122f166fe5a54b10cc75c4c13e433959109d7b76022275abcb1d36f1638afa330948ec72546c91206838985f72ba9aef2dc0fbfed6040
-
Filesize
1.2MB
MD5dfc44da585098a19baae29abde0af7a9
SHA113ee486b1f04ef7b01106006b117d5e90e5b28bb
SHA256b0c00b565d415cba8eec22337c442bf99c5c767637455770fc2580f2bb673bae
SHA51244399b0d7c66c2d516631a84eda3de1f602d1d1506234fd8eb913b0ae53b8e4c77d963d1cb1ad6fa285a4fc0b717752d1678a8dd31b1d1d728a706209fe8ee79
-
Filesize
1KB
MD5fe0d2ef95f9f8f811a076b82fc49d72d
SHA1626aa09660d63c9e34d59cea3b0e9b7f52cffec4
SHA2566cb2a9ede118560b53642a7231c25a5e5215ad576c7908fa19667692c78d3947
SHA512e552ab5383d3ebe8c519da3de756a3d7e4f85336f069141433c65fb24f1700212455a0414a210766b43450387e9e4c92dd377646216a71978038de3b0f263672
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
293KB
MD5e19d102baf266f34592f7c742fbfa886
SHA1c9c9c45b7e97bb7a180064d0a1962429f015686d
SHA256f3c8bb430f9c33e6caf06aaebde17b7fddcc55e8bb36cec2b9379038f1fca0b1
SHA5121b9f1880dd3c26ae790b8eead641e73264f90dc7aa2645acc530aad20ad9d247db613e1725282c85bca98c4428ac255752a4f5c9b2a97f90908b7fe4167bb283
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB