Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15/03/2024, 17:24
General
-
Target
cbfd27dde404d77469120bed9bbce202.dll
-
Size
3.7MB
-
MD5
cbfd27dde404d77469120bed9bbce202
-
SHA1
ad3f6b2db5b62b5d60cd897afc61cddd309c601e
-
SHA256
7680c695e0b6d5727a579ec97176868aa3f58f4fc0a9433aaa6d999e18749818
-
SHA512
fbbda697f62273f9964c124d2e24b6d3ba90c28c7053cadf403590860f129bdc9555b679f18cb74c662e2efbf686f22dded317a8f9ab8e5d37126a773e0b877e
-
SSDEEP
12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1OSuQ2:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbfd27dde404d77469120bed9bbce202.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\rxJ\wusa.exeC:\Users\Admin\AppData\Local\rxJ\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exeC:\Users\Admin\AppData\Local\0C2Drnyq\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\YXXYMPR\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5c7c4b55a7bf4ea49e168b482fdfc9bb3
SHA19f7a775bc8c3125ee22b50656ae46ef9504c5a89
SHA2564bcacf4ca3b0376d3c8953fa332e5217afb6b8f596d0a68414b3c07c000a3c5f
SHA512a76af24ef2a8d614ce69877c83ab91ffe1ffe6df6171067d869325fb41c5526d81eee21715e6558aa67931d01eb75a8ef5e82ab18c971ebdcfe529a1fad85283
-
Filesize
585KB
MD5e344a976c7004c71bf43d9740a162b59
SHA1fc69dc489767504e3042125ce718de2c21d48fff
SHA256aff2bb9661fbc83126ea8e9656b20290f5ea37806ccd915cc89ed563d65a60d7
SHA512fdd58c61b7624e2fa40be710cbeb9a0e2bb7adb033db9f070b9c2fdef9477e0cc9a8c90e9845939891e371473710e7bd596dbb3317ec3ef4ac44fb78245f65a0
-
Filesize
65KB
MD53fb9e2bfd9258aeb25fdf2fdcc042806
SHA1df6c523f04cd395e49ff1260c5fb108133ef75d2
SHA256385d5104d848d311b5f0b0f5cb926ea916137e5ef27eebd5bee5033cd2364176
SHA5126c31c9d3d0aa28aa048e27528310b5c206421ea4b462c0447e1929b3e19f39ad398c67136c1b79c5c8dfa28a2a3abe21fe5e3049cba08a7d8058ef0055823ac4
-
Filesize
50KB
MD5c86924316652124f52d307b43c6f64e8
SHA1e198d4ad17bc9e8391932dd443c06bd166e9d10f
SHA2569976867301b0c3c834fa9c4ddaf289740068f3b04d980621d694b91689544624
SHA5129830c6bbcb1962297b1cf4bb8acfe37bc133c461a9cffe24c7d15cc25536f9c14901a8c70db935b38788636d9f6ffebed525ca4f7eeac87dd862194bfabdf504
-
Filesize
501KB
MD5a06283d7b0bc0aef1fbf854970ca305a
SHA16266731b68b306f811c5949ef45e3339f07cd93d
SHA256935a28e368fc1cd243b7aad3051c6e93dda6b60fa32cd3997a1b47ebaa40f8be
SHA512b91c44363223d9e5ecd54d10816400615e9d780fdfd31dc0df4f2c3fd0c571f59a259cf93338bf47a4bd462dbb13d78c800543cf9fd355d52bc5b212460c00ae
-
Filesize
503KB
MD5bf08341d1b21ae6bfc883560c55f1e2e
SHA1558d609386cf58f73d8ffea593b2c887c727d6cc
SHA2566ccc43dab4ff204e3d987c0fb79c576722bf05f26f8aeecce75f23e58a4235f7
SHA51296e10769f71ef8308fc56c6f97f35b1992d0f7c1bb28dfb474c6a9ec2221c23fe55f478e954039e1424e8b6fecc33c2fe550291c00f301b90bac7a87b0cbb3ef
-
Filesize
540KB
MD556a627469aa4aa87e0592e3002668a0c
SHA170436df1cd1b2601239cf106c15761a27a8e8041
SHA256faa2c039429bf9c0ef13d82e7f462b04932e1b29ed4921ca1c1eae851fe9f584
SHA51298e6aedb23f564f10f50988d35eebb1a51c62450d68b59ba3759c39f5d36eb52789f0eee892f2cc915991828a493d308853ab598c49a10bd76ef160e5f9740e8
-
Filesize
462KB
MD58f48f49e383ecba0621bd5bf4de0f848
SHA14aa4277f1a1405a1c6530200483b9f97228e4148
SHA2563a242c920145c15454d0b6a2c443225913290ce345f22eb44db67aeabddcb01f
SHA512e7f347484b125af7e55886cc0dcc222a5eaa261d63b1ef858523edce97edb4d593b53420ae1f016275953323f0bd2e96f7a3f0c30c1408ef953ff4f7ee1f9c2f
-
Filesize
341KB
MD586be12b6378660ae183775e8a86d7f7b
SHA1c16e144bc1b863213584cdf9f548a43c73ed41c7
SHA25628428ac5035889252d53cf14da6f2ddbf750828a52760d373c0a17f44e425202
SHA512821a615cc661f0bf05a021334627f9244781d306a4bc51920f183f1816e7fc84a13df4758d36d3aef3f2e7f4822b6aa80da5141438033fb3883dfc6c7400eb62
-
Filesize
318KB
MD56560c5de8e0e34a8717ceaf14f9eaaf3
SHA1b3b77848e9f65e6d540195e801cd4e112104ee69
SHA2566324003a017a1a4114398c53bb48b9ddd443f0357ecd1c5796e17ef0fd6a2abb
SHA5123637d1358a2f92ccda0cbb980d6bbe4188ab0dc799675d24db5618b2cc2af34fa1b61c9134d61d915280b59af6ead7509f6bd40e9bc49bd1ff792a03a1b67a5d
-
Filesize
56KB
MD504e88df423d1f71de38c9be4b9cd9a0d
SHA1f7f9a5d20a3358856160f37d896c64e7962bf331
SHA256985341277f3eb637534de7d3d0f23fcde3cbc527686db43a9373297b97cacbd0
SHA512536c3ebfa1794c23e2ecb44033c58c6121901644a4757aa6613f44c6593e5510812c12d83a8e7491a14aa3488dcafe883215f56ec45c1f8b8b8fe8ab297a9d42
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1KB
MD5a8cfc9e2b8b8853a66e1500db1d433af
SHA1151d08ec619c9ee0136070eae8408bc7f468dd5f
SHA256731580f3fc593cc0d029641f01a338f79c5a0aedf9f8f98d1d03fee0feef4f87
SHA512447638b3b53aafbf4ed8a0c0e3faaff605828433a25f7c1a2ae2a1609f6bdc16dca70a7e051ee0c9ef353bdc39060e58d2db78e88fab7de7c41c4f3fbd4b3104
-
Filesize
3.7MB
MD507a1b78893fe396f283b08da4f781efa
SHA143632cfe52add17ec09c28937117b26f964475e5
SHA2566f087a13f58f211141d9ad8910acdd46dfe3a2869cc81d868d741267755d5942
SHA512611430aed497956682b733cbc7905e126a77bbf9d2df0ca716bdce7fcaf3e21733d4becbfb01d3f27a8b8ac0952f38c5097931778d65dbd9b551e0c5195dc459
-
Filesize
3.7MB
MD562b8b0d2aa969b23737fbe548c3c4339
SHA1510a85039a043fa83ca78dbcb0ca4d4c6164a326
SHA2560e6383abc957a8474449a3a0bc9c9eacf2f2b1406e790b12e2551b67fec427e1
SHA512391a3e00c6832b97ab9b9c77ab0781288865d1fb0e4b7225ea45e57279b21d69bcd45111d746ba03b40bd09afe48a32e0be3a43a3b8396c1ad129127a4048de7
-
Filesize
3.7MB
MD53205aacd4b6de3a0abf5911568342715
SHA12ccb22e57ebc8e09673fd0501eb7d6596fdf476b
SHA256c7dcec943db6753d6baf5c888c2c69b4995d67d134c79b9f95550716ba60db5f
SHA512e6e0d95b318d7842d14fcd403694072da494d82887daaf3fe8262a79991006a75a91cedbc995ed146027cf6f5c8f803de5fa3f957a498db9fbe6ccd10fc9b308
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
28KB
-
Filesize
3.7MB