Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/03/2024, 05:49
General
-
Target
b6a95716e500957dc3b9447faf3443d8.dll
-
Size
688KB
-
MD5
b6a95716e500957dc3b9447faf3443d8
-
SHA1
efa033e42ed5c72417bb6cbe8d2dfb4705bce230
-
SHA256
cfdf6cc09e2a199c461f5cab2c28a42e9d979cf64ac4af8e85d9ed5e97d9559a
-
SHA512
9fb14331cd6b7a24c2ff6b0d9f196815e1774f66018af60cdb4405a1c251f9345e5c6a24172b813943f2be1e2a42c3e6d0595c9c9b5421facc6d29956e082c72
-
SSDEEP
12288:VqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:VqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a95716e500957dc3b9447faf3443d8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\zcWvi\ie4uinit.exeC:\Users\Admin\AppData\Local\zcWvi\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\WGS29Q\WFS.exeC:\Users\Admin\AppData\Local\WGS29Q\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\Ljru\ddodiag.exeC:\Users\Admin\AppData\Local\Ljru\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
692KB
MD5f9c163574126f9fcc633087552577dd1
SHA1195f1c3cd88453650635a6a96c9aee4bbafd5cf7
SHA2564eee932fd53be8a1577e9b6e07061e9a9cb918aa5f090fbb0b6cf12c821db745
SHA5122715d66c8a36b9a9b9ef8fdb836b9047b44ccf3570a8f9bc1a14bd7da19e875d30fb06f85d4f8c0289e81e92f3d65813d3e70aba2df3052ff669c3a1665d4271
-
Filesize
39KB
MD585feee634a6aee90f0108e26d3d9bc1f
SHA1a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA25699c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff
-
Filesize
692KB
MD54ae14cdfe62f8444a4afb61b22339aee
SHA1e07dbc7a2b526a60b69fc8c60c111b404d0a2b26
SHA256d07b8d9dfb5765e0c38817c4e0969cf5ca8bedf1d13e74e456585f79b4638c17
SHA512ca760937b2bed5a7856cc4f2702a13795f718e6ad8817070aa3dbf76b7cc2eda17e7b4dd28bd706877c2f5070471a96d635085368af8cc624174d6ea65cc59d1
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
692KB
MD50977ab176ddb15a3e1c63dcfe19331bc
SHA1947c566782963212458c710e2a37f14b41b70ba7
SHA256c99ed7c4e2c4a05955f03f0414db8ac3a35c4c73374bd7b071db9be1d48e6e5b
SHA512aa86bfb5e9065b37fdc417ad7a49a3de9919fed2b56a9714e9d5a12d99956b33bdaa6209a08af26b61b62971d5dd7a1972114a5dd70b3c698130348e8c4515ef
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1KB
MD504304ea216b17312c98f83a514a40dfd
SHA18fa9d69db849966b99cd2e2ec30d87f954b73449
SHA2562b03b12ddc6eb8754300d3f7ed34e17a9f89615f2cf3f5766291b72724e28a7f
SHA51218d5214ea1e5f14021befb3ea6074d7586d690bc8031d5f688b59abe4dc73077dc0cae4312b14c53ea07ae2f08d9c213330bb93a374656d7b26b352bf7bc675f
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
28KB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
28KB