Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18/03/2024, 16:29
General
-
Target
d3fa6fcc3a459eecd5f814bd57b697ae.dll
-
Size
1004KB
-
MD5
d3fa6fcc3a459eecd5f814bd57b697ae
-
SHA1
62d3d9e4786e08e375dd4b3129ffffa8a1094c3f
-
SHA256
39c60c6c9f0757516684c5667be66d03e241ac56e792e570398e91781a85865e
-
SHA512
f1e30751409d71eddb8a60eb6b7b51efa0d70671482a35a93a8b8d023cf76dd05eb259fc751d634e0a589b09c5a2ae5bcb8d995d5b35195bda35218c6e9ed5f3
-
SSDEEP
12288:d6BBWGJW6eC85Df97+yXUj7SncCxj8iHGo59S1WQSCtEdFO7YKJf6:d6BQBjlc728jo7S1bl6FbK
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3fa6fcc3a459eecd5f814bd57b697ae.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\N5ir\DisplaySwitch.exeC:\Users\Admin\AppData\Local\N5ir\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\uumA5\sethc.exeC:\Users\Admin\AppData\Local\uumA5\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\xlDc\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\xlDc\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD527bd2390f04f9995e33fef5428c5fe08
SHA1ac7afb3d620946a643b41fbb9559ab618fcdcac7
SHA2569bc9f0f39cf20e926967fec5de9616a1a35a383a3af1cc65c822f9634c2806b7
SHA512c715d7e781b30a3cf0a2e9348ba6f5333eb58a0ea45c33b5ca606d9a56219c8b56bef5e330e0390e3520397542d0865610a6778d902408894a3bd8ec483a4c7f
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1008KB
MD5929af66079d66616379986e3a2966bb1
SHA1a946a9190692aa0a8ffe95725a0aaf22cb904026
SHA25609b59524e0fa6d379f02591885dcc4ac18011e03633bc761bf23a34756dd38cd
SHA5125e78dab6e5ddc9de886a202aab03ba52f6403b525ca20f49e8c1b9a6f42a3438f76f23af3ce3395f9a6e62e838074944de663911300e094d56ae74d5fba04924
-
Filesize
896KB
MD5bf875fbc9fffafe69c826bb26979e79a
SHA1a88ebb1b1cb42bf8f9fcb8faed7a485c7bc8251a
SHA256d8f2bf1f3d67a4841bf79fea6916d87c22d07fe449ec809c7bbfd919a9e40dbf
SHA5129c5d6e46d33ff2a9fcf6450a90d320acf94b87335dceb1517c42dd714f9f726534caa42a449b9b8f582782c933014fda9344f0f251d81661f8091c4fd916105e
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1008KB
MD533caf2f808daa7ae4b8e56f87e6e6d83
SHA1e91bd2fd194942a7a2984dfdec777f36e252b1d9
SHA256e045d05d54ec0efa0e683e3154c624937e71719c59ec4122e56490e1d5d4cc3e
SHA51295099bb97e08ee9eeb568309c1fd075cfe9a08d6264b76b79dda7fdfdc0cbd4a069075069cff33c39452c2c68d147e881fa7b5d76855f5c8ac5855ecfbcdbbe0
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1KB
MD59cb4d936ef55d63aeab0f2485679a736
SHA10987fc341359439a4416b24468705583e84455ad
SHA2566de82c5a8ee013c79b61ac3953ae1deb76156dcd5d0fb4fe181a92dfcb39acb3
SHA51224d5088a6839179139c1efa02c8189a98efbc52d5af257cfc9718b7bf8e35388f0fde860b863dc01830ecce4f2b9d4f25f87063974c7f1303a06e1a8e218b338
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1004KB
-
Filesize
64KB
-
Filesize
1004KB
-
Filesize
4KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1008KB