Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02/10/2024, 02:46
General
-
Target
0880db875d3faf856245d738b7e0a25a_JaffaCakes118.dll
-
Size
2.4MB
-
MD5
0880db875d3faf856245d738b7e0a25a
-
SHA1
38d0242a90bdc46d7cf3bf3a1b5e0013c23ba0a1
-
SHA256
cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed
-
SHA512
8696984083fcbe4426976bcb9d6793f6d8653572f747e5095c5413a4ea60a985d54c6fc421a6622d0e3a66b1c4df8069aafc39f2ab88c0aecfbe9f4fed1a56e1
-
SSDEEP
12288:yQVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1AZ:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0880db875d3faf856245d738b7e0a25a_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\kdb\dialer.exeC:\Users\Admin\AppData\Local\kdb\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\k8vCJbZ\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\k8vCJbZ\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\PLs\slui.exeC:\Users\Admin\AppData\Local\PLs\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD584fc48616257697a654bf50496fe8e41
SHA1097ccc4080552f36fbbb5e7fc4d04a228fafb8ba
SHA2567abfe01618a11f625e38d7da81de56ad1c22035c6a7079cac203e962fe0c72d0
SHA512a311711e9bc227cd0be2acdc624e6ecce2e166f75b168790d4b84cfe117307ea6a7fd6cc4fce87a6e7e03a134bbdbd16ca8da3c935fd1b837814adae042a1c42
-
Filesize
2.4MB
MD50495206b683e8b67c4352819b1f96dab
SHA18a6fc40dc14f1e23e640d383f362fbff417ef83f
SHA25627defcc7b9834d5e5d318a25c4dadf708435cbe2fc7b05bb4e882718a2db3557
SHA5120d12ae49c1cc77b019fc4524672f9eb9dc177e52bb923b8a7d13bf212a942e02ed11f85ec687b4cd0d235146c6f754c1176be148093266f1b2af913c54358d8c
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
1KB
MD5e9aa08760f86787b99d7607c723d0b02
SHA155c1e85fcbf56ee674928f004b3861ad60964107
SHA256f419283d8cad470ad0cc54c7bd69c64fe32fd49d1ba55216756fa1b4b8572971
SHA512be1c15dee7d95820a7e972607850c663871d35f48cb6d2f802b82f33a29b50339289dc3ae99542f78faae8d0fb9046765b2ec5552a927ff22a5aaf90d84737c8
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
2.4MB
MD5db67d75cb55a7b2264966fcfbe83ad9b
SHA181ced0e1327c6cc823402757a12c8b887e923b6f
SHA2565d3feb82b9ca63c999b476a4a6ec7562312ccd7abea4a8a7143b825e9ce48d76
SHA512c7c418513a569b87ed4257f4b26148e0a78ebbdb419c03b392c5aef74d7300a1135ea250ccb7c47620c72d997897958846bb2473f4a3d3433948b58f77fdfea2
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
28KB
-
Filesize
2.4MB
-
Filesize
28KB