Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 17:24

General

  • Target

    cbfd27dde404d77469120bed9bbce202.dll

  • Size

    3.7MB

  • MD5

    cbfd27dde404d77469120bed9bbce202

  • SHA1

    ad3f6b2db5b62b5d60cd897afc61cddd309c601e

  • SHA256

    7680c695e0b6d5727a579ec97176868aa3f58f4fc0a9433aaa6d999e18749818

  • SHA512

    fbbda697f62273f9964c124d2e24b6d3ba90c28c7053cadf403590860f129bdc9555b679f18cb74c662e2efbf686f22dded317a8f9ab8e5d37126a773e0b877e

  • SSDEEP

    12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1OSuQ2:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfd27dde404d77469120bed9bbce202.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:4780
  • C:\Windows\system32\wusa.exe
    C:\Windows\system32\wusa.exe
    1⤵
      PID:3200
    • C:\Users\Admin\AppData\Local\rxJ\wusa.exe
      C:\Users\Admin\AppData\Local\rxJ\wusa.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:1740
    • C:\Windows\system32\Taskmgr.exe
      C:\Windows\system32\Taskmgr.exe
      1⤵
        PID:3812
      • C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe
        C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4196
      • C:\Windows\system32\ApplySettingsTemplateCatalog.exe
        C:\Windows\system32\ApplySettingsTemplateCatalog.exe
        1⤵
          PID:1844
        • C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe
          C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3384

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe

          Filesize

          76KB

          MD5

          c7c4b55a7bf4ea49e168b482fdfc9bb3

          SHA1

          9f7a775bc8c3125ee22b50656ae46ef9504c5a89

          SHA256

          4bcacf4ca3b0376d3c8953fa332e5217afb6b8f596d0a68414b3c07c000a3c5f

          SHA512

          a76af24ef2a8d614ce69877c83ab91ffe1ffe6df6171067d869325fb41c5526d81eee21715e6558aa67931d01eb75a8ef5e82ab18c971ebdcfe529a1fad85283

        • C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe

          Filesize

          585KB

          MD5

          e344a976c7004c71bf43d9740a162b59

          SHA1

          fc69dc489767504e3042125ce718de2c21d48fff

          SHA256

          aff2bb9661fbc83126ea8e9656b20290f5ea37806ccd915cc89ed563d65a60d7

          SHA512

          fdd58c61b7624e2fa40be710cbeb9a0e2bb7adb033db9f070b9c2fdef9477e0cc9a8c90e9845939891e371473710e7bd596dbb3317ec3ef4ac44fb78245f65a0

        • C:\Users\Admin\AppData\Local\0C2Drnyq\credui.dll

          Filesize

          65KB

          MD5

          3fb9e2bfd9258aeb25fdf2fdcc042806

          SHA1

          df6c523f04cd395e49ff1260c5fb108133ef75d2

          SHA256

          385d5104d848d311b5f0b0f5cb926ea916137e5ef27eebd5bee5033cd2364176

          SHA512

          6c31c9d3d0aa28aa048e27528310b5c206421ea4b462c0447e1929b3e19f39ad398c67136c1b79c5c8dfa28a2a3abe21fe5e3049cba08a7d8058ef0055823ac4

        • C:\Users\Admin\AppData\Local\0C2Drnyq\credui.dll

          Filesize

          50KB

          MD5

          c86924316652124f52d307b43c6f64e8

          SHA1

          e198d4ad17bc9e8391932dd443c06bd166e9d10f

          SHA256

          9976867301b0c3c834fa9c4ddaf289740068f3b04d980621d694b91689544624

          SHA512

          9830c6bbcb1962297b1cf4bb8acfe37bc133c461a9cffe24c7d15cc25536f9c14901a8c70db935b38788636d9f6ffebed525ca4f7eeac87dd862194bfabdf504

        • C:\Users\Admin\AppData\Local\YXXYMPR\ACTIVEDS.dll

          Filesize

          501KB

          MD5

          a06283d7b0bc0aef1fbf854970ca305a

          SHA1

          6266731b68b306f811c5949ef45e3339f07cd93d

          SHA256

          935a28e368fc1cd243b7aad3051c6e93dda6b60fa32cd3997a1b47ebaa40f8be

          SHA512

          b91c44363223d9e5ecd54d10816400615e9d780fdfd31dc0df4f2c3fd0c571f59a259cf93338bf47a4bd462dbb13d78c800543cf9fd355d52bc5b212460c00ae

        • C:\Users\Admin\AppData\Local\YXXYMPR\ACTIVEDS.dll

          Filesize

          503KB

          MD5

          bf08341d1b21ae6bfc883560c55f1e2e

          SHA1

          558d609386cf58f73d8ffea593b2c887c727d6cc

          SHA256

          6ccc43dab4ff204e3d987c0fb79c576722bf05f26f8aeecce75f23e58a4235f7

          SHA512

          96e10769f71ef8308fc56c6f97f35b1992d0f7c1bb28dfb474c6a9ec2221c23fe55f478e954039e1424e8b6fecc33c2fe550291c00f301b90bac7a87b0cbb3ef

        • C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe

          Filesize

          540KB

          MD5

          56a627469aa4aa87e0592e3002668a0c

          SHA1

          70436df1cd1b2601239cf106c15761a27a8e8041

          SHA256

          faa2c039429bf9c0ef13d82e7f462b04932e1b29ed4921ca1c1eae851fe9f584

          SHA512

          98e6aedb23f564f10f50988d35eebb1a51c62450d68b59ba3759c39f5d36eb52789f0eee892f2cc915991828a493d308853ab598c49a10bd76ef160e5f9740e8

        • C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe

          Filesize

          462KB

          MD5

          8f48f49e383ecba0621bd5bf4de0f848

          SHA1

          4aa4277f1a1405a1c6530200483b9f97228e4148

          SHA256

          3a242c920145c15454d0b6a2c443225913290ce345f22eb44db67aeabddcb01f

          SHA512

          e7f347484b125af7e55886cc0dcc222a5eaa261d63b1ef858523edce97edb4d593b53420ae1f016275953323f0bd2e96f7a3f0c30c1408ef953ff4f7ee1f9c2f

        • C:\Users\Admin\AppData\Local\rxJ\dpx.dll

          Filesize

          341KB

          MD5

          86be12b6378660ae183775e8a86d7f7b

          SHA1

          c16e144bc1b863213584cdf9f548a43c73ed41c7

          SHA256

          28428ac5035889252d53cf14da6f2ddbf750828a52760d373c0a17f44e425202

          SHA512

          821a615cc661f0bf05a021334627f9244781d306a4bc51920f183f1816e7fc84a13df4758d36d3aef3f2e7f4822b6aa80da5141438033fb3883dfc6c7400eb62

        • C:\Users\Admin\AppData\Local\rxJ\dpx.dll

          Filesize

          318KB

          MD5

          6560c5de8e0e34a8717ceaf14f9eaaf3

          SHA1

          b3b77848e9f65e6d540195e801cd4e112104ee69

          SHA256

          6324003a017a1a4114398c53bb48b9ddd443f0357ecd1c5796e17ef0fd6a2abb

          SHA512

          3637d1358a2f92ccda0cbb980d6bbe4188ab0dc799675d24db5618b2cc2af34fa1b61c9134d61d915280b59af6ead7509f6bd40e9bc49bd1ff792a03a1b67a5d

        • C:\Users\Admin\AppData\Local\rxJ\wusa.exe

          Filesize

          56KB

          MD5

          04e88df423d1f71de38c9be4b9cd9a0d

          SHA1

          f7f9a5d20a3358856160f37d896c64e7962bf331

          SHA256

          985341277f3eb637534de7d3d0f23fcde3cbc527686db43a9373297b97cacbd0

          SHA512

          536c3ebfa1794c23e2ecb44033c58c6121901644a4757aa6613f44c6593e5510812c12d83a8e7491a14aa3488dcafe883215f56ec45c1f8b8b8fe8ab297a9d42

        • C:\Users\Admin\AppData\Local\rxJ\wusa.exe

          Filesize

          309KB

          MD5

          e43499ee2b4cf328a81bace9b1644c5d

          SHA1

          b2b55641f2799e3fdb3bea709c9532017bbac59d

          SHA256

          3e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb

          SHA512

          04823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Bgoltaavvu.lnk

          Filesize

          1KB

          MD5

          a8cfc9e2b8b8853a66e1500db1d433af

          SHA1

          151d08ec619c9ee0136070eae8408bc7f468dd5f

          SHA256

          731580f3fc593cc0d029641f01a338f79c5a0aedf9f8f98d1d03fee0feef4f87

          SHA512

          447638b3b53aafbf4ed8a0c0e3faaff605828433a25f7c1a2ae2a1609f6bdc16dca70a7e051ee0c9ef353bdc39060e58d2db78e88fab7de7c41c4f3fbd4b3104

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-399997616-3400990511-967324271-1000\m1HcBKg\credui.dll

          Filesize

          3.7MB

          MD5

          07a1b78893fe396f283b08da4f781efa

          SHA1

          43632cfe52add17ec09c28937117b26f964475e5

          SHA256

          6f087a13f58f211141d9ad8910acdd46dfe3a2869cc81d868d741267755d5942

          SHA512

          611430aed497956682b733cbc7905e126a77bbf9d2df0ca716bdce7fcaf3e21733d4becbfb01d3f27a8b8ac0952f38c5097931778d65dbd9b551e0c5195dc459

        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b2ju\ACTIVEDS.dll

          Filesize

          3.7MB

          MD5

          62b8b0d2aa969b23737fbe548c3c4339

          SHA1

          510a85039a043fa83ca78dbcb0ca4d4c6164a326

          SHA256

          0e6383abc957a8474449a3a0bc9c9eacf2f2b1406e790b12e2551b67fec427e1

          SHA512

          391a3e00c6832b97ab9b9c77ab0781288865d1fb0e4b7225ea45e57279b21d69bcd45111d746ba03b40bd09afe48a32e0be3a43a3b8396c1ad129127a4048de7

        • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\YQKBUAf\dpx.dll

          Filesize

          3.7MB

          MD5

          3205aacd4b6de3a0abf5911568342715

          SHA1

          2ccb22e57ebc8e09673fd0501eb7d6596fdf476b

          SHA256

          c7dcec943db6753d6baf5c888c2c69b4995d67d134c79b9f95550716ba60db5f

          SHA512

          e6e0d95b318d7842d14fcd403694072da494d82887daaf3fe8262a79991006a75a91cedbc995ed146027cf6f5c8f803de5fa3f957a498db9fbe6ccd10fc9b308

        • memory/1740-110-0x0000000140000000-0x00000001403B9000-memory.dmp

          Filesize

          3.7MB

        • memory/1740-105-0x000002ABA1F50000-0x000002ABA1F57000-memory.dmp

          Filesize

          28KB

        • memory/1740-103-0x0000000140000000-0x00000001403B9000-memory.dmp

          Filesize

          3.7MB

        • memory/3384-147-0x0000000140000000-0x00000001403B9000-memory.dmp

          Filesize

          3.7MB

        • memory/3384-143-0x0000023F3ADA0000-0x0000023F3ADA7000-memory.dmp

          Filesize

          28KB

        • memory/3384-140-0x0000000140000000-0x00000001403B9000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-25-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-53-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-27-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-28-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-29-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-30-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-31-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-32-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-33-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-34-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-35-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-36-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-37-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-39-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-40-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-38-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-41-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-42-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-43-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-44-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-45-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-46-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-47-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-48-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-49-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-50-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-51-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-52-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-54-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-55-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-57-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-58-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-56-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-26-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-59-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-63-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-66-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-65-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-64-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-62-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-61-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-60-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-74-0x0000000002000000-0x0000000002007000-memory.dmp

          Filesize

          28KB

        • memory/3584-82-0x00007FFD8A1E0000-0x00007FFD8A1F0000-memory.dmp

          Filesize

          64KB

        • memory/3584-6-0x00007FFD8908A000-0x00007FFD8908B000-memory.dmp

          Filesize

          4KB

        • memory/3584-17-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-20-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-24-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-23-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-22-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-21-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-19-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-18-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-5-0x0000000006DE0000-0x0000000006DE1000-memory.dmp

          Filesize

          4KB

        • memory/3584-16-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-8-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-15-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-14-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-13-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-12-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-11-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/3584-10-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/4196-128-0x0000000140000000-0x00000001403B9000-memory.dmp

          Filesize

          3.7MB

        • memory/4196-123-0x000001DCD7C30000-0x000001DCD7C37000-memory.dmp

          Filesize

          28KB

        • memory/4780-9-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/4780-1-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB

        • memory/4780-3-0x000002293EC60000-0x000002293EC67000-memory.dmp

          Filesize

          28KB

        • memory/4780-0-0x0000000140000000-0x00000001403B8000-memory.dmp

          Filesize

          3.7MB