Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
05/03/2024, 19:37
General
-
Target
b58179d2876272ed58a6e2d6c328be3c.dll
-
Size
848KB
-
MD5
b58179d2876272ed58a6e2d6c328be3c
-
SHA1
2d8a3a857491b3523f93b08e0611e741925be9ac
-
SHA256
548a21178bd299e07a0b0bb0957decd17f937a37b8fe4fbc8125e360bb1f0679
-
SHA512
ea4162f81987df295e7c1a568dc98ad440b34d2d17eaffa74250513199b33d873279a6b4af2c1df8805f61afadbc20c508b4bce3b7d6fcca239e89ac4dda24cc
-
SSDEEP
12288:4kbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/R:4kbHkWfzZ5adwLNGeStHntqN7v
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 13 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b58179d2876272ed58a6e2d6c328be3c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\cMc6V\TpmInit.exeC:\Users\Admin\AppData\Local\cMc6V\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\blwL\unregmp2.exeC:\Users\Admin\AppData\Local\blwL\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\iHYsYhrY\mmc.exeC:\Users\Admin\AppData\Local\iHYsYhrY\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\VqCfdS\raserver.exeC:\Users\Admin\AppData\Local\VqCfdS\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
MD51ab8e59b989828910915b2ce98dec339
SHA1029779de896d87268a21b95346f2929f3f0b9097
SHA256de1691dae460f67ae71974250e5587ac038ecdc654d6a6e361050b7563058581
SHA512fb8f5f59ea04ced739bec8096e7785db4b5eea190207338f45d17c9fb53f6f80834c40021353da0f217cb7a3634f6f9f77d762e35ac01d1da21416a50104f236
-
Filesize
852KB
MD5d8073c3ae06011f96d1270727de13a0b
SHA147fde93d1e1746fc7b7896d4701923628ba109ce
SHA25646f07fda77900f702dce14f92b4c6b5e16989d590494a03af08ebf96c8caa378
SHA5122e885ffe8a2f89dbc2aede7bf941264f38fe6a18fcb3f3765e74cfbb2b53c8b44c07b711d90eb6fd04e5fde9fb91ffa47d3041dee3f3dddf29f2bd7568064cf3
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
852KB
MD5fed5912662eaf991bfcd67973225349f
SHA10973e6c1b3d7f1003371cfabf8cbf9e72e0235b4
SHA2567f0fc12e54787fff1135f21a5ad282828d92c3327ba3ca28bf612a085301a0d2
SHA512bcefea4c8855d86abaaf952af617ab7ab5b008b554c562e8357a1c059f1c739bdab4e2f2995439a3e74ed81fdb1634842d543fbcc6edf5432c44efa775bf88c3
-
Filesize
876KB
MD5129f1ffcb8df0d7a5047635eeec63ec4
SHA1e916078aec1960a67b1ccb80e8a6373dcde7f604
SHA256540c6a9713aecbf18a445b57aa01b3f47f9883f5f67a56ff0f95a79f4f65e0e0
SHA512a06c3c09da370f8fe42b4107a1cc76f84f921b669852602d78071e29531bacdc74c109b42fc071592e1f7d137feb71b63e8737ad2c980f8153b24e220f2051a1
-
Filesize
1KB
MD5de1364cfe562492778abca26d66a9d96
SHA15eb366c7dc347ea67de623e6066e439b05319317
SHA2565580fae46fbbf6d3ee40e96409711eb3a1738c7483c230b8a896d50130453b56
SHA512963d99ec46099c273976e458bd752237eb2704e4be09a30fce3c2c9ef8e99657ca55977742dfe8c684def55c8252cdbddf02afef8f78030e634966ad1ec6cb04
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
28KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
848KB
-
Filesize
4KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
4KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
876KB
-
Filesize
876KB
-
Filesize
28KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB