Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    125s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2023, 12:05 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe

  • Size

    277KB

  • MD5

    c320b92bf3dc3125845a26087d78eb56

  • SHA1

    5544668d26b72e5dba7f085941cf4f1bd663192c

  • SHA256

    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018

  • SHA512

    7c4d6f286333469925f0d326d336f90c7f17301e531e7ecec1d775628a002106d9cecc8c423c7a6df5e3864474c5cc4a4979c88211ebab444072829cf9480770

  • SSDEEP

    6144:IXzKdNY49u8rVK8vWykw+atfHcHx1SFeFZ01netR:3a4AXYTkjatfHuxAEZ01i

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe
    "C:\Users\Admin\AppData\Local\Temp\3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:2028
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:2268

Network

  • flag-us
    DNS
    www.programworkshop.com
    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe
    Remote address:
    8.8.8.8:53
    Request
    www.programworkshop.com
    IN A
    Response
    www.programworkshop.com
    IN A
    64.106.220.214
  • flag-us
    GET
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe
    Remote address:
    64.106.220.214:80
    Request
    GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
    User-Agent: /DownloadSecureBrowser
    Host: www.programworkshop.com
    Response
    HTTP/1.1 403 Url not valid
    Cache-Control: private
    Content-Type: text/html
    From: P03
    p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
    Date: Sat, 05 Aug 2023 12:06:00 GMT
    Content-Length: 1233
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    214.220.106.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.220.106.64.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.136.241.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.136.241.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.141.123.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.141.123.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    90.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    90.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 64.106.220.214:80
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    http
    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe
    603 B
     1.7kB
     6
    4

    HTTP Request

    GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

    HTTP Response

    403
  • 8.8.8.8:53
    www.programworkshop.com
    dns
    3a2b8740706175e2b9489ad8f961333fc0211599388b34abaaad713e04680018.exe
    69 B
     85 B
     1
    1

    DNS Request

    www.programworkshop.com

    DNS Response

    64.106.220.214

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    214.220.106.64.in-addr.arpa
    dns
    73 B
     154 B
     1
    1

    DNS Request

    214.220.106.64.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    254.136.241.8.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    254.136.241.8.in-addr.arpa

  • 8.8.8.8:53
    233.141.123.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    233.141.123.20.in-addr.arpa

  • 8.8.8.8:53
    90.16.208.104.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    90.16.208.104.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

    Download Submit

  • memory/1620-133-0x00000000007D0000-0x0000000000870000-memory.dmp

    Filesize

    640KB

    Download

  • memory/1620-143-0x00000000007D0000-0x0000000000870000-memory.dmp

    Filesize

    640KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.