ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

dridex

windows10-1703-x64

Sharing

General

Target

ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d
Size

1.4MB
Sample

230923-rrfl3agc7w
MD5

912b3d39206444e12610f816cadd801b
SHA1

3f6f811088fb22af54191c59515aaba7df3dd523
SHA256

ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d
SHA512

095020944a6bd0cfa8b626ff94a6dcc22f84d6f7b25b889fd9e4be07c6310cbc119cd37e269d23a1b1cfc492ec3c89b0a73c0aa8f06c09d307861549435782ac
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d.exe

Resource

win10-20230915-en

evasion persistence upx

windows10-1703-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d
- Size
  
  1.4MB
- MD5
  
  912b3d39206444e12610f816cadd801b
- SHA1
  
  3f6f811088fb22af54191c59515aaba7df3dd523
- SHA256
  
  ddd306f21f061faa70d8ae4cf5ed6df3876b0960b03af3e836359e030384203d
- SHA512
  
  095020944a6bd0cfa8b626ff94a6dcc22f84d6f7b25b889fd9e4be07c6310cbc119cd37e269d23a1b1cfc492ec3c89b0a73c0aa8f06c09d307861549435782ac
- SSDEEP
  
  24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Firewall
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.