Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/10/2024, 23:42 UTC
General
-
Target
64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118.dll
-
Size
872KB
-
MD5
64aceb8bda31f573a45db0ea2c70c918
-
SHA1
448bbb8dfded2f51b6b098cb2d650c961d0275b8
-
SHA256
00a4f5b50c281942629456327a8a4772f28e234abcb4dc6ecd755ff849714a93
-
SHA512
201c607317f291c84f417ca9b3c9c371c85140283c9d9279b62a8c46682224411ac3d612eafd95b606564893bea354df6af0ec7e443ae300e5862b591605e19f
-
SSDEEP
12288:SdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:kMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64aceb8bda31f573a45db0ea2c70c918_JaffaCakes118.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\fmK\wextract.exeC:\Users\Admin\AppData\Local\fmK\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\OQvoc\rekeywiz.exeC:\Users\Admin\AppData\Local\OQvoc\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\1qY7t\DWWIN.EXEC:\Users\Admin\AppData\Local\1qY7t\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
876KB
MD53c908e29b9de09d30d827bac0a568bd2
SHA1edc865e419165ed07dcf36ba190385b5065c301e
SHA256334722c5c38bfe0459efbfb3781bf89b1ec4705cc41b0458bb5c4ba7c0a7e604
SHA5120d0ed0e31a1f1030517cf245c9bb0702988694d3c4e1dacf3ef77cb694d9bd638cc1d8b30a4053570e98fc96035206932f80d31f4fc5d71eb85976633feafaee
-
Filesize
876KB
MD5be668902fe0c6b3b83a9d1901930b8e6
SHA1ff0fae849d293104be73b7f5cb43854bfb4bb44f
SHA2561c9d950656ca1c74487aa7480ab9403d0a8e1a5f32e8cc68d5cc9b944d50fed7
SHA5121873263203321da9f98cde5e915c64c2de3ded6865a5239024bbd321baacefa1afc0f993881750ce58e4fb6f6ee19503f20aba5003fb45c76c575e9c529a1ffc
-
Filesize
876KB
MD55b2aa432a4097dab56e658409ae329d8
SHA112207b45bb1ea732fc255eaeab9b41123b152ff5
SHA256a4af529c486364e5db33fe05d50455e93c598ae97f560ea9425e68af6dd08ece
SHA512438ffe8f23ec9793b2b3b1a9bb67665a251d6e465cbe46f98f2d4843801ba97e926279d89ff177e0ed7993aa45d666622878f7968695a98a94e8728eb7429946
-
Filesize
723B
MD5d1852e4af6331c4ec319536407071077
SHA14746fabfa424f6656ab94faa68d36de5c2da1809
SHA2565504e7ccd52a6544305ee5d30b04128b4a46f98e88554116caa232df45ae9069
SHA512857f588ec5c6fedea7ab270d243f4a9a13943c4dde4e8fdac97b9924fa0baffaf461a810c613a99697c0a4c47c07282cc384e7b86a22bcc2005eb1878368a462
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
28KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
28KB
-
Filesize
876KB
-
Filesize
872KB
-
Filesize
28KB
-
Filesize
872KB
-
Filesize
876KB
-
Filesize
876KB
-
Filesize
28KB