Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    137s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2023, 00:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe

  • Size

    277KB

  • MD5

    2f3d5145dffb1f7195cef31afed8b2c1

  • SHA1

    773d8a189ce3df704bc5c742a9ed5908b60b747b

  • SHA256

    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2

  • SHA512

    522b9d1bc3eaf8d729e3d2950cf94dac965d2dc2153bda09a4fb704d51d78b5d8e02d1803e8ef6edc4eea8a8b76cf48ea3bb3f21c7ed1dc4780c0df1349eace2

  • SSDEEP

    6144:AXzKdNY49u8rVEaKCTASgv3IXNPPi01netj:/a4A6gSgvYi01M

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe
    "C:\Users\Admin\AppData\Local\Temp\07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:916
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:2664

Network

  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    173.223.113.131
  • flag-us
    DNS
    176.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.122.125.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.220.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.220.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    fe3cr.delivery.mp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    fe3cr.delivery.mp.microsoft.com
    IN A
    Response
    fe3cr.delivery.mp.microsoft.com
    IN CNAME
    fe3.delivery.mp.microsoft.com
    fe3.delivery.mp.microsoft.com
    IN CNAME
    glb.cws.prod.dcat.dsp.trafficmanager.net
    glb.cws.prod.dcat.dsp.trafficmanager.net
    IN A
    20.3.187.198
  • flag-nl
    GET
    http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
    Remote address:
    173.223.113.131:80
    Request
    GET /pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 2185
    Content-Type: application/octet-stream
    Content-MD5: SKMDF/LJRl3iDIfcbnSOzA==
    Last-Modified: Tue, 06 Jun 2023 21:31:17 GMT
    ETag: 0x8DB66D55CCBC630
    x-ms-request-id: bc9f940f-e01e-001c-27bf-9815d0000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 07 Jun 2023 00:08:58 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCV308db342.0
    ms-cv-esi: CASMicrosoftCV308db342.0
    X-RTag: RT
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    131.113.223.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    131.113.223.173.in-addr.arpa
    IN PTR
    Response
    131.113.223.173.in-addr.arpa
    IN PTR
    a173-223-113-131deploystaticakamaitechnologiescom
  • flag-us
    DNS
    164.113.223.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    164.113.223.173.in-addr.arpa
    IN PTR
    Response
    164.113.223.173.in-addr.arpa
    IN PTR
    a173-223-113-164deploystaticakamaitechnologiescom
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.programworkshop.com
    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe
    Remote address:
    8.8.8.8:53
    Request
    www.programworkshop.com
    IN A
    Response
    www.programworkshop.com
    IN A
    64.106.220.214
  • flag-us
    GET
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe
    Remote address:
    64.106.220.214:80
    Request
    GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
    User-Agent: /DownloadSecureBrowser
    Host: www.programworkshop.com
    Response
    HTTP/1.1 403 Url not valid
    Cache-Control: private
    Content-Type: text/html
    From: P01
    p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
    Date: Wed, 07 Jun 2023 00:09:01 GMT
    Content-Length: 1233
  • flag-us
    DNS
    214.220.106.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.220.106.64.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.121.18.2.in-addr.arpa
    IN PTR
    Response
    83.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.103.197.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.103.197.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    229.78.74.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    229.78.74.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.113.223.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.113.223.173.in-addr.arpa
    IN PTR
    Response
    99.113.223.173.in-addr.arpa
    IN PTR
    a173-223-113-99deploystaticakamaitechnologiescom
  • flag-us
    DNS
    46.46.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    46.46.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    250.255.255.239.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    250.255.255.239.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    70.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    70.121.18.2.in-addr.arpa
    IN PTR
    Response
    70.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-70deploystaticakamaitechnologiescom
  • flag-us
    DNS
    1.202.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.202.248.87.in-addr.arpa
    IN PTR
    Response
    1.202.248.87.in-addr.arpa
    IN PTR
    https-87-248-202-1amsllnwnet
  • flag-us
    DNS
    47.125.24.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    47.125.24.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    76.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.121.18.2.in-addr.arpa
    IN PTR
    Response
    76.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-76deploystaticakamaitechnologiescom
  • 40.125.122.176:443
    276 B
     6
  • 173.223.113.131:80
    http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
    http
    458 B
     2.9kB
     6
    5

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl

    HTTP Response

    200
  • 20.24.193.65:443
    tls
    7.0kB
     12
  • 40.125.122.176:443
    260 B
     5
  • 64.106.220.214:80
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    http
    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe
    603 B
     1.7kB
     6
    4

    HTTP Request

    GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

    HTTP Response

    403
  • 52.182.143.210:443
    322 B
     7
  • 20.82.209.183:443
    156 B
     3
  • 20.82.209.183:443
    46 B
     1
  • 93.184.221.240:80
    46 B
     1
  • 20.82.209.183:443
    46 B
     1
  • 93.184.221.240:80
    322 B
     7
  • 93.184.221.240:80
    322 B
     7
  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    173.223.113.131

  • 8.8.8.8:53
    176.122.125.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    176.122.125.40.in-addr.arpa

  • 8.8.8.8:53
    29.220.184.93.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    29.220.184.93.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    150 B
     309 B
     2
    2

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    fe3cr.delivery.mp.microsoft.com

    DNS Response

    20.3.187.198

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    131.113.223.173.in-addr.arpa
    dns
    74 B
     141 B
     1
    1

    DNS Request

    131.113.223.173.in-addr.arpa

  • 8.8.8.8:53
    164.113.223.173.in-addr.arpa
    dns
    74 B
     141 B
     1
    1

    DNS Request

    164.113.223.173.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    www.programworkshop.com
    dns
    07e661247677c24302be40fa36caf4403c8c921c0e3e9161a2eb3f1db59d8fa2.exe
    69 B
     85 B
     1
    1

    DNS Request

    www.programworkshop.com

    DNS Response

    64.106.220.214

  • 8.8.8.8:53
    214.220.106.64.in-addr.arpa
    dns
    73 B
     154 B
     1
    1

    DNS Request

    214.220.106.64.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    83.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.121.18.2.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    14.103.197.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.103.197.20.in-addr.arpa

  • 8.8.8.8:53
    229.78.74.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    229.78.74.40.in-addr.arpa

  • 8.8.8.8:53
    99.113.223.173.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    99.113.223.173.in-addr.arpa

  • 8.8.8.8:53
    46.46.119.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    46.46.119.40.in-addr.arpa

  • 8.8.8.8:53
    250.255.255.239.in-addr.arpa
    dns
    74 B
     131 B
     1
    1

    DNS Request

    250.255.255.239.in-addr.arpa

  • 8.8.8.8:53
    240.232.18.117.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    70.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    70.121.18.2.in-addr.arpa

  • 8.8.8.8:53
    1.202.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    1.202.248.87.in-addr.arpa

  • 8.8.8.8:53
    47.125.24.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    47.125.24.20.in-addr.arpa

  • 8.8.8.8:53
    76.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    76.121.18.2.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • memory/2368-133-0x0000000000380000-0x0000000000420000-memory.dmp

    Filesize

    640KB

    Download

  • memory/2368-147-0x0000000000380000-0x0000000000420000-memory.dmp

    Filesize

    640KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.