Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/08/2024, 15:02
General
-
Target
c90f1183641a387ea5575b5e9cfc3823_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
c90f1183641a387ea5575b5e9cfc3823
-
SHA1
7f54137d178f58adab7e50adaf3c2d48dc5b4607
-
SHA256
849f991381c28c420499f0dd6871940f7074637575f5dc3c6e5826962c87351d
-
SHA512
977c1b03b575156862324347ba97d88f8dc3fdd46ef1b6b7e7e6ba933cd22151af2609e87ff13e9655b131b839ca8efd67aa9406e9d34e2cded8e51b6676938b
-
SSDEEP
24576:uuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N2:O9cKrUqZWLAcUO
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c90f1183641a387ea5575b5e9cfc3823_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\0s7H\xpsrchvw.exeC:\Users\Admin\AppData\Local\0s7H\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\9vhB\vmicsvc.exeC:\Users\Admin\AppData\Local\9vhB\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\N6B\wbengine.exeC:\Users\Admin\AppData\Local\N6B\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
1.2MB
MD5dbf2e72968541bc35e987fcdf60cf9f3
SHA1cf2a497cc13da5c5d8cc88f4ccbcddf2ef2b6b58
SHA2567d19625ec7008202d1e4cd88f628339015a0f908ba1556606191aa2125766a5f
SHA51261e4dbd68a512553504b7e52d3ac3d63fe6c9595a827a7c3faf0d23a5d12ba8349a0b815137f66b73c9d1742b26f6aec580f70114c8bff94e04935f9e78f0752
-
Filesize
1.2MB
MD58e7415df451e6b4f9cc898f995f0403e
SHA1c5bc6fddce5d2283af174208fa73ddb35e6384c0
SHA2564ab345bcdcbeb7e20530946bf82a3598deb9bf3fedfd392c5faa2d2c099f66c5
SHA512de00fa441ac954a138c1be4b9cd50e3dd42faaabcc2f749901e915d322ab236aa7f675fb1da536b3717cbcac5c3c51e8617b8e49e779d6456388c7f9921ff671
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
1KB
MD5f2d17e5efcc740641a27b5dd072a3275
SHA15841fb1a4b217c80345491b5618c1657f2613445
SHA2568028d1b108871e34533c120435fc08df31b12c71d13a6e237d500fb89bac6698
SHA51271f8041c75c7783de0bee8bbac53320172d4858a9955ef0364e594cbfad92ae608482d2a4ca5dd2d56a5a16772ef06c6df3d94320930303ae13f58386f180edf
-
Filesize
1.2MB
MD5362f7196ca911ce9d9a107654d1d0a65
SHA1d6f4a4576fa409a70a9fb362d78ddb82f834d706
SHA256a3e690bfea81d262f7ff97e652294c5169d45769554aa97ce84457822cc5a3f4
SHA512ab9b7262f1d3583ecc1d84e3325fca72aa83551c67d9848d4b4681a70e2b29bae509176167dc37a5e65b92f64a4ba2a3f7022ea7cd39c6f194e9589c13f3b765
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB