Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
29/12/2023, 21:19
General
-
Target
044a52b7c4b41c9724c7abef08920300.dll
-
Size
1.7MB
-
MD5
044a52b7c4b41c9724c7abef08920300
-
SHA1
b23c372109b9d0b392d7b9fd5cdb1c25735f4047
-
SHA256
9dfe843a61c3bd78c30380d5c132273913dcd3872a2a8649ffe93b4d43ed3445
-
SHA512
7f70ce66d7bbb8955e787abc966be3dcc98c0496d9ef5c0212e89a9cc8029cbbf7d11e16c294b2f2323b2d612a16f276cdaffc13c14c379c7f8507a9ed069b03
-
SSDEEP
12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\044a52b7c4b41c9724c7abef08920300.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\wrLuVnFL4\wbengine.exeC:\Users\Admin\AppData\Local\wrLuVnFL4\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\pzGsQB23\mspaint.exeC:\Users\Admin\AppData\Local\pzGsQB23\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\SutzP4d5\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\SutzP4d5\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
73KB
MD5c08a3d80d2301228c77e5d91038bf015
SHA16f26075238948c164fcdcd710c424bb5449d1173
SHA2561ee863e9cd47e378869cc8579dd8c5f41d10e3facc6b1f6de8c0b8a83c3d67a2
SHA512919db9d6a4e90d0125973a35c12b23d6d46b6e15846dbe8eb027e198a4606e100fdc541a87f8a8dd9faa2de169380a5242bc3cdd71bd0912153ada146ee8df33
-
Filesize
123KB
MD54259cab06977e37063bb89f2664eee59
SHA1fbac8d1e70fda03f3edc9cbf931ef0e412dd63b1
SHA256c48e023bd0ab917fca0d5e462055d5429e788449b39ef49f3b341e7162529091
SHA51205631c302a8da79edc61061057c7ff7b058ef66747f4488a78ea0a982dca89927b0315b260e65603bd4726b3077d98df7a47753576dc8db5026b1adce8d00c96
-
Filesize
14KB
MD5f60fb1dccf8903dcfc3923a0bc92d01d
SHA19ed13c6c611c0ee4981cfa2c55d27bbe28b46599
SHA2569bf546c771e3ec8a7c0913cdffb23cce0a4237d99ce680d17d0d5f6ebb4affed
SHA5129b6ca1a0733f0fe467daf38e94399de7c0621819d6ed1c4cbe2ab2b42877123fba4a35040ba550d220357945bae5298971ef301fff51b76dcf40ac23a4fd9e49
-
Filesize
48KB
MD5940cc4a1be43db028b8068b122765394
SHA14529f8a772af8e26d73c3984b50c0ac6b8c672cd
SHA2563dd058b65501b82304fc1768602896c3e70cd66f31dd496ccc21b714768b882f
SHA5121d4014f7dbaf5dc357ade6f7a80fe42f742fa8c51f1418668573779a611d75788bc76f0e057da10de2235149374e4724cd7516b7e33748bc9555821b16389d6a
-
Filesize
24KB
MD53cbfa96d6235191a14af0346a0c04cf4
SHA1b2f723f864da1d8f669c46e13fa26741a7c595ae
SHA25631c898c5ccc43604d8c678df364c900b5737cd578fd7966dcc83fa1a38c9fc66
SHA51230d463b7f47361919b0ab01a3fc3239afa3b9c46bc01e498081274ce1136c7fdeabbd6ecbd5c92d1503e30fbc2cad55ac38e6cba29723b130e3e92ebd499f33b
-
Filesize
84KB
MD55d280fed9beb03af7d8740d332d4026c
SHA17402636ceffdb01673fe79973d7fbd137a6e6522
SHA2562921a4a967d88614370bb5249ff069c304b463d804f3bb9401e914ed8600a1ae
SHA512b60abde3e31923eb04457f89a6d7f9807740539cec8366c3117fc83b0ba962602be2755d56f332385f9fc5e8de094a925f9fd1a3b0acea9bd46e3e6e2b9367e8
-
Filesize
117KB
MD5e0c7183bd79a367e2fee037d6deb1dc0
SHA1a07be57d29212bb8449b5f78ace6a4858e276b3b
SHA2567ca60029c03db80dbaffda45c6414ecadfd5b6637110a73136da88b415075eb9
SHA512ed1cb16603bf497e30c1c24327d9d1541ea0f3384fb91ddff44d1a72555b11b33033985a8fca56133b3e3fb9010a7fe8c61a199277b71397271701ece741214b
-
Filesize
62KB
MD575e92e16080e5c1bb668462fd0bc067b
SHA12923fd40b3d2248f99d9b6a8439b7a116c80c49b
SHA256e3e07a39d359413ec49a0aa57c77c0552cfe7667cf5e5ceea99c5ed9c839f678
SHA51224d8bc23f67587bf9dd7b19e3cb2dc52e9799708633b651500f6c3ffb8eb6e76e8885a593ba13aa0deaa61aad658fb734155b66198753051e334db3e752c5847
-
Filesize
106KB
MD5a7de03fb91ec679f783bd4a34babf16e
SHA1f951b91e6d15654a0f06986a7264733f6048557e
SHA25615c715fd2c91c8c0baec031b60421ba98927e7ddea90f8e23730a69e2fe4ad5a
SHA5123b6c26302443e58e909cc8684d708e0198f03f1157414a136da782b5981cbf8d44a07ea757898ca6809a4f2e80a000c7f136265f5d3966fdd7098d4b34e8fea2
-
Filesize
71KB
MD516c0e4752e41c65b449c551593a92775
SHA165c276bfb86067fa94e6891d90516e82aca5abd9
SHA25656f16bf4d3757dd2e66efb69b6915bcb62f01ea7802f70c827c2e945d024d982
SHA5126fb915d2da16ca214627275b6890f9eed54e16de198a76ce4bd020541d206730769bb0bc63686d51848f1eb19f75f19bbefbecada1d5112c04b054eeea6ee528
-
Filesize
1KB
MD5183c7bfa1914ed580cb0979b647c71a8
SHA1a3ac844b1498bb7078da91a72fa59c4716ce52d7
SHA2561402f641651af9d22a20d4ee5bfd91a38784aed591fa26d788453d6a755ce1f7
SHA512634b0dce879fd7bbb88d3a06c921d6a4e3337ca682613be884f838093fa36076cf7f540cc63c55bbbe756f5b466fda98d6879cc57c7e52becddfb9cf9eb49356
-
Filesize
133KB
MD5c08098db6d1ea63dda13c25010c24155
SHA1c585c53f7c9071544011ec14b5b952fdfb907993
SHA25659469bb679db7ca4e54ba9c42e39afda40ccf985a29cce597dfa636080258b52
SHA5128674c17180ccdbc0ad8322310dd5f98c1bff969e392b862136a6383550af66fbcc03538fdb1aab6c20ed4dde1c2771f01f2288c47e5a4e6dcc5d70abb8855b4a
-
Filesize
101KB
MD56d62ba678ba3a9a08f7988b24370a293
SHA12887ded83dfefd93a87fd3bfb07e4273e4bc38e0
SHA2563526d468fd2b73042132a8b64e1d2ceea999ffa72283281d7d40075433fe76ed
SHA512319b87dd3ad1e04fa36ffcc4917b6a34b2939d195a022d2c5491222b6ce73aad3a19bcb02993731bf3f5126f8ae19ed3a3596f695dc7acc247af2ae56f63784a
-
Filesize
44KB
MD54bd976d651cc5ff6d14022d77c5c3ce9
SHA11420967513f4033418d48af5f2fbd4b9cfd025fd
SHA256e359ad11090a07638fefbe8a983f484f32bbc084b7377113d239a903c93f6867
SHA512a349874040718612b62f2a6b8905a6109890b6a18c58b0c0a0fc4db1ed596df73502369f7554d683c29603d4b9af9886f8d5e7e7d5dad4ce3d6cb0006c72fd12
-
Filesize
39KB
MD5fd12c6d6a5dd23600200dc799bb3c603
SHA124cd273398d2c405536af5ce4d86a112ed689096
SHA256314030cb358bf2c6d438a19d9c0eb45987eb306655ec7fc05a835dec9533307c
SHA512f311c47b545838b651e8f824a5fd8d0836ec62c6c4aa6daba4954a1ba43a84083955e896ae128efc7a98705f4d3730a4facd1687479fd08c3fd7107d04bb8aae
-
Filesize
9KB
MD53bfca312db57e667cbb45e7cffeb47f6
SHA15ec8428bb1c186f74588dfe39b25ef6617945242
SHA2560def40f188f8a69cb4fd4f18bd4ba7484d074a90b77e7b0ffda593232502cf3e
SHA512c71f36bff177523f54e0eeb94e6c170fe4ca292ae71d5c2bc342d79ee17e153333173b758f8e9c80c6cc4905780e1d1a6d5f99b7c0ab68ec4336a56561ea79af
-
Filesize
105KB
MD5d13177d65892d21a28470f80b830b198
SHA1743f58a3655ad0d10eda865e9174d78e2b3bf550
SHA2566a24d136d754eea9c618ba55dc39e437f27369bc546f40d8323e21a700d7e255
SHA512a800a907a6447f66a3c03e84f1248309a5345dae898df261a9e3f0876782ac51b213efffff11c5085a9caabf7bd37ced52270ea0d5c0d867b8435112ae71fe13
-
Filesize
78KB
MD57986637f34f8dd84371415b56c413a78
SHA16075c4d4b3db1c53dcd3061c603d3b6dec0456f9
SHA256ac30dbd513b6909264d960622914407d1a22869c14fc0f443b23eedf1cc47b96
SHA51282f0d16ec98f0fa281aae9ec2a04ffa581346e71e7a8f3aa1b9e4e79e286aeebdc8c02b59c02f51cc61fdc84d01a43ddc5a3a38cfdba2756c30245a6564c9b70
-
Filesize
38KB
MD594a0489aa504481b4a63fd8af79b8944
SHA1cd716c694567e38830d089ef90b92a9a7f894f9a
SHA256847424e0b6c0c8827b502d8938360ff06b778289ee079497e99779266cf6818e
SHA512ce63a955c9f8f3f49af1c70b642712272e51b250bbab47203a79a623443fa089dfa09297a665ec160e8805510f94414b3f56f0ea4e4986789106a9ea3dc93936
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB