Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 21:19
General
-
Target
044a52b7c4b41c9724c7abef08920300.dll
-
Size
1.7MB
-
MD5
044a52b7c4b41c9724c7abef08920300
-
SHA1
b23c372109b9d0b392d7b9fd5cdb1c25735f4047
-
SHA256
9dfe843a61c3bd78c30380d5c132273913dcd3872a2a8649ffe93b4d43ed3445
-
SHA512
7f70ce66d7bbb8955e787abc966be3dcc98c0496d9ef5c0212e89a9cc8029cbbf7d11e16c294b2f2323b2d612a16f276cdaffc13c14c379c7f8507a9ed069b03
-
SSDEEP
12288:uVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:zfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\044a52b7c4b41c9724c7abef08920300.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\bRu\mfpmp.exeC:\Users\Admin\AppData\Local\bRu\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\idfnX4Ny\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\idfnX4Ny\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\MBTvBe\msdt.exeC:\Users\Admin\AppData\Local\MBTvBe\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD56c432773d1fb43322f688af16066bd17
SHA18c9c30a95887286166b54ba464cbcdae78db6e94
SHA256de2ea0a4e5f78ebe413467c361b2889f8431d000833f2d8c1c0315035d8f72cc
SHA51218c4d621a8bf2da7b7f4d613e7cae490e85004cf5d13d55c76b4290a8faa6d94627ff162b646bc0fa0d34835e51fe4f512d303f55ed19cf03562fe4f15ad43ce
-
Filesize
2KB
MD5533b215cc6ec1ef25762ab5b7074f352
SHA1d354138b3c72f5130733824bcf3df31ae7c69231
SHA2561369def94b7ff0171320c60dd68bb04a5e6389e697d24a9e182eca52423cd7d3
SHA512a3bc810ad6cdf6c3d35267d381680ff50e61bf6e53144de1773dc6686fbfcca061f86c3d3716cb457a0e5fbf439c7a7d2cd58475a89f54a5e6703488efedd0b0
-
Filesize
124KB
MD52cc5329b04c58dbe82f9e74db823dad9
SHA14fe06b00b59901664d2d7a64c2eaf62ecb1b2fc9
SHA256a3860495038d21f02cb2f823ba1127591ece5f35995effb02f21ea97f0260786
SHA5125050e4f5e696ae6df71bd522f21548d18aa42965b82ad97b8e15e9b7a99a92dc497f45aaca3e6dd12be741defd92a8d5645195d290b62fddb7dcc2fdb6bfa7c8
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB