Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 17:24
General
-
Target
cbfd27dde404d77469120bed9bbce202.dll
-
Size
3.7MB
-
MD5
cbfd27dde404d77469120bed9bbce202
-
SHA1
ad3f6b2db5b62b5d60cd897afc61cddd309c601e
-
SHA256
7680c695e0b6d5727a579ec97176868aa3f58f4fc0a9433aaa6d999e18749818
-
SHA512
fbbda697f62273f9964c124d2e24b6d3ba90c28c7053cadf403590860f129bdc9555b679f18cb74c662e2efbf686f22dded317a8f9ab8e5d37126a773e0b877e
-
SSDEEP
12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1OSuQ2:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfd27dde404d77469120bed9bbce202.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\slKo1\osk.exeC:\Users\Admin\AppData\Local\slKo1\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\7ix\raserver.exeC:\Users\Admin\AppData\Local\7ix\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\V1en\Dxpserver.exeC:\Users\Admin\AppData\Local\V1en\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD57c741a8d59caac78b2e6c82a8a4522ee
SHA1cc65c89e987e5ea12f94455032ca376d89035673
SHA25603f6b0c2ba44736e5cf1b9cbff300a10aefb21a086638209b2ef5115cdcddb6e
SHA51265cc2cbe7845dcf27e9e4eb1ca932a9ef2dc8d2e0bb5d90a4a5d3adb98e39cbe6996a1b381a4f1fcbe66c3ed969a0eee09d4bc53c848ab13a722b137f34eda3f
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
64KB
MD5afa448d4f32a100d79a92b810a186134
SHA10730f11792b08dac0c51b3a3bab6e82159754f3b
SHA2561520fe771206411abee2ba69a307ef7020e0aa8a0f69540e39c995a010fc3bd9
SHA5126369ca19fc6ad2c0052547bf4771f38067c60f1bdca95ea16580466a0eada0b6e4c8b2f00e72bd4fd506770a52a380e54bef1dcc1c875dcc9f51a6509bb6edbd
-
Filesize
64KB
MD595f6942757d03300dee7e5901b0497fe
SHA15b30c6f76e965880e8f794423653914960d7af43
SHA2562551b3ff8d7fff9a0f6b016264283fde40147e13e476bc52c85c6b837d7b25b6
SHA512d2258544d0496192660897c3746b29dcd697dc75a419503746ff2175e1b9b55e7d3fab006522af4df9176200b975ee0d47effe5f3e0b1d4eb7829552fbd11120
-
Filesize
968KB
MD5e03751055fb720e3383af6110e9beaf5
SHA1644e84f5442c010adb5d953b7d435639cb8de226
SHA25609c3cc4d3d0a62ece59a5c2833ffa3698cfc983ec365691c1e542fe4ee479592
SHA512bdc653e6337fac425f838fe63c3aae50295491fbea9f282a79808ed3d6616cffac460933367f244c16d83f32243f1bd58674dc1f499ebeea3c3cd32822ee8f26
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
976B
MD5afbc32a549015b7a251a2228fd0f2b58
SHA15d851b7436c8254125f7e8ff42fdfdca273d521c
SHA256de4654542d3cb6d91094d0f29138d62a8591e615f0709f836cfd148e49881664
SHA5122229807fc2da83e736f5a320da96e278880e102446c469b7bda7fe7f277e2a9c181b8617732d5d8847e237ff6660a5f02bcbec582729d2047ac00b5cdda18d9a
-
Filesize
3.7MB
MD573ed39ce4b3acc701b066463434e1044
SHA14deb6c23e4424405076fd023b07a98f96c7f3e60
SHA256f1bcc6db84ad15322d868ee469eaa3cd5758ca27c5bad8011297ea487c4171e2
SHA5123e54489023954b99781dab670b6ec842d14ed9231c434290dbce48f9f3913f57ec0a83519365c052cdc0126ac0a945a2afd4ee5251280e4bc91c299fcbd25865
-
Filesize
154KB
MD57f4254cc8264d2c75a2966cecda77b23
SHA12753a074e88b5acb9cbaf1d2b989b323eacd1961
SHA256cc5111211390022b709650008979403a6c8360df958358cec66084ffc08fc502
SHA5125382256097c1d2c464abf338128ce7da27862bf17510adf9bf7d5b3d04426a70aaa9197ec48419a6699e0e02effafbf04f23e0ddcf63cb1a983c5847916239fb
-
Filesize
3.7MB
MD5774fbf51a76fac8204b7a1c2089b7c14
SHA17bdd9460948aba6c57f958e1ddb9490b8c4f660e
SHA2569a4d76982944d9c2e8b8c0bf597e7a3b4f01579a5ef6f7ce1eb895b0f2f44b53
SHA5127ac4d3fc840cccd87d70e0f08f173aa6a138818ae1a21dadfd442f289151537ad4bfa7d21eebec3852e60bd6422a25fb8cf636033332d246f8cb04cc1241c0db
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
3.7MB
MD571e901588246a9fd4b2edd7fd8a3b787
SHA19b72acc1702912ddfeabb21e7eee60bdf8c69812
SHA2563d89ffb4733b0f70577b470d3a0ceddba0781e9a95bc3537d2f64c2caa02ff11
SHA5122289cffc1cc50c29f330de6175ff2a41f92ef078e964ed2ba687582aa6bd57c32cbb6bbe2a4c5e99e5dadfea92e2cc2d746f3f3f25dd17ad59b48e204bd5db3c
-
Filesize
979KB
MD539ff0fd5c62ddf79b73a6804921d7d5f
SHA1f29cb7ea7d3b7292d02e71abdeec0e8fe5c2f0a5
SHA2563045dba7f5f4f9ba29b58e7ee18d408ea9f24d65553400b2bc148c7998c9c18d
SHA512f6bc476d2da15a0cb2c83f76c264df64f34cdeb1dc33d8a39c2a3c57d631b5b0a0af03e5321fce4e7c13019b4cd4140ba6783c028511d75522e6f3598df2aa7a
-
Filesize
568KB
MD599906cc5dfe5fbfa52b9c5b1694357d3
SHA19100736a1c95ac2a81b69d8499fa809f71cf2c83
SHA256bbea08a668c99df40026f7e9b1acac033ecaec6e3f7cea10078e8a3df2d064ea
SHA5126fcd9ff3d66f1f8820ea260609630b911cc069c1e688de3b00104cf1cde16e357c6de7edac756d8cac15e56933fd9db82b722c2db0320b65c528451e73456f41
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
3.7MB
-
Filesize
3.7MB