Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    102s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2023, 13:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe

  • Size

    277KB

  • MD5

    c4b74e6f30e5cc879ebcca154a18a865

  • SHA1

    f5e3bb8e467631f0f6babf925983946758719117

  • SHA256

    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd

  • SHA512

    65bff879124d85ff71f360ccbe605513c80da75d0a8b9e1799a7d97e4b5fe1b4fb52af5c67bc3db80977024c08934988dbff880a79b918a5d3013692204354d7

  • SSDEEP

    6144:mXzKdNY49u8rV8HrEosHHN4oqXG/uq01netB:9a4A1rTsHt4j+01S

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe
    "C:\Users\Admin\AppData\Local\Temp\d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:1336
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:1784

Network

  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.programworkshop.com
    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe
    Remote address:
    8.8.8.8:53
    Request
    www.programworkshop.com
    IN A
    Response
    www.programworkshop.com
    IN A
    64.106.220.214
  • flag-us
    GET
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe
    Remote address:
    64.106.220.214:80
    Request
    GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
    User-Agent: /DownloadSecureBrowser
    Host: www.programworkshop.com
    Response
    HTTP/1.1 403 Url not valid
    Cache-Control: private
    Content-Type: text/html
    From: P01
    p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
    Date: Wed, 31 May 2023 13:55:50 GMT
    Content-Length: 1233
  • flag-us
    DNS
    214.220.106.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.220.106.64.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.23.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.23.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    203.151.224.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    203.151.224.20.in-addr.arpa
    IN PTR
    Response
  • 64.106.220.214:80
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    http
    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe
    603 B
     1.7kB
     6
    4

    HTTP Request

    GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

    HTTP Response

    403
  • 20.189.173.10:443
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 173.223.113.164:443
    322 B
     7
  • 173.223.113.131:80
    322 B
     7
  • 204.79.197.203:80
    322 B
     7
  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    www.programworkshop.com
    dns
    d97f577decc7f276c2d83ff6ad2b57a74cc079d61af97108f70a04dafba8f9bd.exe
    69 B
     85 B
     1
    1

    DNS Request

    www.programworkshop.com

    DNS Response

    64.106.220.214

  • 8.8.8.8:53
    214.220.106.64.in-addr.arpa
    dns
    73 B
     154 B
     1
    1

    DNS Request

    214.220.106.64.in-addr.arpa

  • 8.8.8.8:53
    254.23.238.8.in-addr.arpa
    dns
    71 B
     125 B
     1
    1

    DNS Request

    254.23.238.8.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    203.151.224.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    203.151.224.20.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • memory/2072-133-0x0000000000A90000-0x0000000000B30000-memory.dmp

    Filesize

    640KB

    Download

  • memory/2072-147-0x0000000000A90000-0x0000000000B30000-memory.dmp

    Filesize

    640KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.