Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 14:34
General
-
Target
39fddcf4501cfd534f060cd829e875e1.dll
-
Size
1.5MB
-
MD5
39fddcf4501cfd534f060cd829e875e1
-
SHA1
febef1cab017686608c5e3e7d921029dd65ba63b
-
SHA256
3b174d031502a6cbd9f660a76f2b0a6eec4241913ba959030f1d6f6947a82285
-
SHA512
e66c55ab3a5f8e1d75da453fe528a44bcf5446e14243bdb46f0a7af225926fff880489260359b350639fab97bf45b5da59b90e02d0eba0a2c2da224f8831ae8e
-
SSDEEP
12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39fddcf4501cfd534f060cd829e875e1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\3mRsanez\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\3mRsanez\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\ZIuMPKX\mfpmp.exeC:\Users\Admin\AppData\Local\ZIuMPKX\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\WRTOxBC9\unregmp2.exeC:\Users\Admin\AppData\Local\WRTOxBC9\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
301KB
MD5434bf13f549219496c20272bf9faf19f
SHA16fcf995438a60334b1060aba6c860a8e3dd804b4
SHA2566418c63897b92fd5ef6a264b5204d70789011b3569571bd11041960b4effd481
SHA512e0ac0669be2dbf33b407e06b535cbd2ef74142cb7834d5856685e1c91d2354dfc0aa467e3ca76535bca243ed9c839dfb9f99e57e34495435c4b92a128f60a6ba
-
Filesize
195KB
MD57568472dc60879e19c982a22ac44d77f
SHA14474ea4499f8ae90f62d81f50196e495b27e5dd9
SHA256e635075f259aaee223b97e6785ad7e6e9f25987e293fcb0b5e910986e476be83
SHA51285cec32b0628a3079833795662b942c1a6719e2596245d656f4e7e2b5e9ce90332fa5bc1fb1dbe6b0f0257a15f9116beec86cb0c3a8eaa20853d47b1becf06fd
-
Filesize
139KB
MD5fc28ad13f82a41408bcb152ce815a383
SHA191b4004c864a5ca75b439dece10418252de497e5
SHA25667e7a7f8a07da633e58b1ffecb91cefb05856178cccc43c7283ca58d7fae5ee6
SHA5125afef9d0f1db0f93461ec7254907caefc496da4032a7947c1d33adffc6fbb981386898bbf8d0d3df5000c6d6c579fd07f18a8b0c3de477109c43e7bfc4d4dff0
-
Filesize
57KB
MD512da9492800c436535d02bf16153beed
SHA13a0ac61d548c08886c4d7ee017e3537dd5215410
SHA25657681e5c7fc914b1f673ead3e9253b035a20876d85e7a9988396df46d468739d
SHA51230e66ab048a9ad94106963c1214a394acdf4cbaa6e7aef695be4aab9c32c698016450cf3e392fae23c5aee736ce3cd62b46ad68078c7f7d5cc2f090ef8cd86bc
-
Filesize
1.5MB
MD563bb067d454c48d65befdfee23793786
SHA1cce067ce34ba4e0d148f92f583382b24c6aa5c1a
SHA256f381bd7b14f43ecdafd54b62e7838043a8115401e8e4f3cb3a48a41912699353
SHA51262f1fd7a73e5bd2540dc9b90aaf91a9b83afc9a1a126734d300e9b36b0a19819a2c7aaf62c716cb80c7ae979a2dc3196e33782ff05ca0ffb06c045708d0c4ee9
-
Filesize
259KB
MD5a6fc8ce566dec7c5873cb9d02d7b874e
SHA1a30040967f75df85a1e3927bdce159b102011a61
SHA25621f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d
SHA512f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc
-
Filesize
1.5MB
MD58969354e93d15389acba7da524ee708a
SHA1f5dc42611d8791a0132083340fb1f9f8dbe63897
SHA25630daa541ebdb2c58c97b981c4a005b1d58d3397335fd8c36354b4603294e5e4e
SHA512d77b6710d481e5fd86dd2be07a8334e21ad5ca98dc66a978cf4fd58a0813e6d58476d8ca4ffc6f2fe6283a694b224c89453ae6679c9456e33401540458d1f0b7
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
1KB
MD51259ad42d4052e0327d10d11b8fe7969
SHA1067a3a1859ebbb148c37b1bd9cc6ed14ce069bc2
SHA2566b02847baa38707f50de2ef4be14d88ef3b98469cccde11ad557d4f07a664700
SHA51218faf5364d5b0de209e29181feea8a8020c03c74b592ea8823e35af6b14c26ca2ec9b73aec1154621eb7beb48fc88d974b55325772364a3b7937d2f7c87f7af8
-
Filesize
1024KB
MD5ffa3bb2b045132ed5fe943bea33c41c5
SHA1cf062344ba7ed55fd35e2f97a0ad777541d5d17f
SHA256267d8febf02e6ee86b4a45991341c90e093bf066e9ad7160308ad07a3f2c6313
SHA512039de7782beb8e6cc1927b013dd4355a3f982dcd97a01a2e8877750340ee351f4612f96e8be2ac663c3eec202899535c35562cf2e05dc46c9cbb0051ec3d91a7
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB