Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
cbfd27dde404d77469120bed9bbce202.dll
Resource
win7-20240221-en
General
-
Target
cbfd27dde404d77469120bed9bbce202.dll
-
Size
3.7MB
-
MD5
cbfd27dde404d77469120bed9bbce202
-
SHA1
ad3f6b2db5b62b5d60cd897afc61cddd309c601e
-
SHA256
7680c695e0b6d5727a579ec97176868aa3f58f4fc0a9433aaa6d999e18749818
-
SHA512
fbbda697f62273f9964c124d2e24b6d3ba90c28c7053cadf403590860f129bdc9555b679f18cb74c662e2efbf686f22dded317a8f9ab8e5d37126a773e0b877e
-
SSDEEP
12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1OSuQ2:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3584-5-0x0000000006DE0000-0x0000000006DE1000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
pid Process 1740 wusa.exe 4196 Taskmgr.exe 3384 ApplySettingsTemplateCatalog.exe -
Loads dropped DLL 3 IoCs
pid Process 1740 wusa.exe 4196 Taskmgr.exe 3384 ApplySettingsTemplateCatalog.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ymojgrwdyxau = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-399997616-3400990511-967324271-1000\\m1HcBKg\\Taskmgr.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wusa.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Taskmgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ApplySettingsTemplateCatalog.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 rundll32.exe 4780 rundll32.exe 4780 rundll32.exe 4780 rundll32.exe 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found 3584 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3584 Process not Found 3584 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3584 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3200 3584 Process not Found 100 PID 3584 wrote to memory of 3200 3584 Process not Found 100 PID 3584 wrote to memory of 1740 3584 Process not Found 101 PID 3584 wrote to memory of 1740 3584 Process not Found 101 PID 3584 wrote to memory of 3812 3584 Process not Found 102 PID 3584 wrote to memory of 3812 3584 Process not Found 102 PID 3584 wrote to memory of 4196 3584 Process not Found 103 PID 3584 wrote to memory of 4196 3584 Process not Found 103 PID 3584 wrote to memory of 1844 3584 Process not Found 104 PID 3584 wrote to memory of 1844 3584 Process not Found 104 PID 3584 wrote to memory of 3384 3584 Process not Found 105 PID 3584 wrote to memory of 3384 3584 Process not Found 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfd27dde404d77469120bed9bbce202.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵PID:3200
-
C:\Users\Admin\AppData\Local\rxJ\wusa.exeC:\Users\Admin\AppData\Local\rxJ\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1740
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵PID:3812
-
C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exeC:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4196
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵PID:1844
-
C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5c7c4b55a7bf4ea49e168b482fdfc9bb3
SHA19f7a775bc8c3125ee22b50656ae46ef9504c5a89
SHA2564bcacf4ca3b0376d3c8953fa332e5217afb6b8f596d0a68414b3c07c000a3c5f
SHA512a76af24ef2a8d614ce69877c83ab91ffe1ffe6df6171067d869325fb41c5526d81eee21715e6558aa67931d01eb75a8ef5e82ab18c971ebdcfe529a1fad85283
-
Filesize
585KB
MD5e344a976c7004c71bf43d9740a162b59
SHA1fc69dc489767504e3042125ce718de2c21d48fff
SHA256aff2bb9661fbc83126ea8e9656b20290f5ea37806ccd915cc89ed563d65a60d7
SHA512fdd58c61b7624e2fa40be710cbeb9a0e2bb7adb033db9f070b9c2fdef9477e0cc9a8c90e9845939891e371473710e7bd596dbb3317ec3ef4ac44fb78245f65a0
-
Filesize
65KB
MD53fb9e2bfd9258aeb25fdf2fdcc042806
SHA1df6c523f04cd395e49ff1260c5fb108133ef75d2
SHA256385d5104d848d311b5f0b0f5cb926ea916137e5ef27eebd5bee5033cd2364176
SHA5126c31c9d3d0aa28aa048e27528310b5c206421ea4b462c0447e1929b3e19f39ad398c67136c1b79c5c8dfa28a2a3abe21fe5e3049cba08a7d8058ef0055823ac4
-
Filesize
50KB
MD5c86924316652124f52d307b43c6f64e8
SHA1e198d4ad17bc9e8391932dd443c06bd166e9d10f
SHA2569976867301b0c3c834fa9c4ddaf289740068f3b04d980621d694b91689544624
SHA5129830c6bbcb1962297b1cf4bb8acfe37bc133c461a9cffe24c7d15cc25536f9c14901a8c70db935b38788636d9f6ffebed525ca4f7eeac87dd862194bfabdf504
-
Filesize
501KB
MD5a06283d7b0bc0aef1fbf854970ca305a
SHA16266731b68b306f811c5949ef45e3339f07cd93d
SHA256935a28e368fc1cd243b7aad3051c6e93dda6b60fa32cd3997a1b47ebaa40f8be
SHA512b91c44363223d9e5ecd54d10816400615e9d780fdfd31dc0df4f2c3fd0c571f59a259cf93338bf47a4bd462dbb13d78c800543cf9fd355d52bc5b212460c00ae
-
Filesize
503KB
MD5bf08341d1b21ae6bfc883560c55f1e2e
SHA1558d609386cf58f73d8ffea593b2c887c727d6cc
SHA2566ccc43dab4ff204e3d987c0fb79c576722bf05f26f8aeecce75f23e58a4235f7
SHA51296e10769f71ef8308fc56c6f97f35b1992d0f7c1bb28dfb474c6a9ec2221c23fe55f478e954039e1424e8b6fecc33c2fe550291c00f301b90bac7a87b0cbb3ef
-
Filesize
540KB
MD556a627469aa4aa87e0592e3002668a0c
SHA170436df1cd1b2601239cf106c15761a27a8e8041
SHA256faa2c039429bf9c0ef13d82e7f462b04932e1b29ed4921ca1c1eae851fe9f584
SHA51298e6aedb23f564f10f50988d35eebb1a51c62450d68b59ba3759c39f5d36eb52789f0eee892f2cc915991828a493d308853ab598c49a10bd76ef160e5f9740e8
-
Filesize
462KB
MD58f48f49e383ecba0621bd5bf4de0f848
SHA14aa4277f1a1405a1c6530200483b9f97228e4148
SHA2563a242c920145c15454d0b6a2c443225913290ce345f22eb44db67aeabddcb01f
SHA512e7f347484b125af7e55886cc0dcc222a5eaa261d63b1ef858523edce97edb4d593b53420ae1f016275953323f0bd2e96f7a3f0c30c1408ef953ff4f7ee1f9c2f
-
Filesize
341KB
MD586be12b6378660ae183775e8a86d7f7b
SHA1c16e144bc1b863213584cdf9f548a43c73ed41c7
SHA25628428ac5035889252d53cf14da6f2ddbf750828a52760d373c0a17f44e425202
SHA512821a615cc661f0bf05a021334627f9244781d306a4bc51920f183f1816e7fc84a13df4758d36d3aef3f2e7f4822b6aa80da5141438033fb3883dfc6c7400eb62
-
Filesize
318KB
MD56560c5de8e0e34a8717ceaf14f9eaaf3
SHA1b3b77848e9f65e6d540195e801cd4e112104ee69
SHA2566324003a017a1a4114398c53bb48b9ddd443f0357ecd1c5796e17ef0fd6a2abb
SHA5123637d1358a2f92ccda0cbb980d6bbe4188ab0dc799675d24db5618b2cc2af34fa1b61c9134d61d915280b59af6ead7509f6bd40e9bc49bd1ff792a03a1b67a5d
-
Filesize
56KB
MD504e88df423d1f71de38c9be4b9cd9a0d
SHA1f7f9a5d20a3358856160f37d896c64e7962bf331
SHA256985341277f3eb637534de7d3d0f23fcde3cbc527686db43a9373297b97cacbd0
SHA512536c3ebfa1794c23e2ecb44033c58c6121901644a4757aa6613f44c6593e5510812c12d83a8e7491a14aa3488dcafe883215f56ec45c1f8b8b8fe8ab297a9d42
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1KB
MD5a8cfc9e2b8b8853a66e1500db1d433af
SHA1151d08ec619c9ee0136070eae8408bc7f468dd5f
SHA256731580f3fc593cc0d029641f01a338f79c5a0aedf9f8f98d1d03fee0feef4f87
SHA512447638b3b53aafbf4ed8a0c0e3faaff605828433a25f7c1a2ae2a1609f6bdc16dca70a7e051ee0c9ef353bdc39060e58d2db78e88fab7de7c41c4f3fbd4b3104
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-399997616-3400990511-967324271-1000\m1HcBKg\credui.dll
Filesize3.7MB
MD507a1b78893fe396f283b08da4f781efa
SHA143632cfe52add17ec09c28937117b26f964475e5
SHA2566f087a13f58f211141d9ad8910acdd46dfe3a2869cc81d868d741267755d5942
SHA512611430aed497956682b733cbc7905e126a77bbf9d2df0ca716bdce7fcaf3e21733d4becbfb01d3f27a8b8ac0952f38c5097931778d65dbd9b551e0c5195dc459
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b2ju\ACTIVEDS.dll
Filesize3.7MB
MD562b8b0d2aa969b23737fbe548c3c4339
SHA1510a85039a043fa83ca78dbcb0ca4d4c6164a326
SHA2560e6383abc957a8474449a3a0bc9c9eacf2f2b1406e790b12e2551b67fec427e1
SHA512391a3e00c6832b97ab9b9c77ab0781288865d1fb0e4b7225ea45e57279b21d69bcd45111d746ba03b40bd09afe48a32e0be3a43a3b8396c1ad129127a4048de7
-
Filesize
3.7MB
MD53205aacd4b6de3a0abf5911568342715
SHA12ccb22e57ebc8e09673fd0501eb7d6596fdf476b
SHA256c7dcec943db6753d6baf5c888c2c69b4995d67d134c79b9f95550716ba60db5f
SHA512e6e0d95b318d7842d14fcd403694072da494d82887daaf3fe8262a79991006a75a91cedbc995ed146027cf6f5c8f803de5fa3f957a498db9fbe6ccd10fc9b308