Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 22:52
General
-
Target
4052ea9b3c06054603457627da4cae9a63458f725fb8c5b017fc406b7b03fccd.dll
-
Size
820KB
-
MD5
09a70175b2dac63c54bdca38cf4262e8
-
SHA1
1791add74d6e0cc4e3a2f3727a55abaab8ab0463
-
SHA256
4052ea9b3c06054603457627da4cae9a63458f725fb8c5b017fc406b7b03fccd
-
SHA512
99e09a0df392d62f34dcef06f210b897670bbc45cc5589957f339fe63f96f5d92168948a9aa515ecfa235aff981ddb9be4629a36f28b11122152dcb6811111f0
-
SSDEEP
12288:uBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdND:6/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4052ea9b3c06054603457627da4cae9a63458f725fb8c5b017fc406b7b03fccd.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\SWv56RnJq\unregmp2.exeC:\Users\Admin\AppData\Local\SWv56RnJq\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\KKimKcer\SppExtComObj.ExeC:\Users\Admin\AppData\Local\KKimKcer\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\mue\FXSCOVER.exeC:\Users\Admin\AppData\Local\mue\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
MD541617a2716125313346eb795a7cfeb63
SHA1b09f46fe89ce8b2f7177c8e1b7c0b3860ef79c94
SHA256c004eab8efe0d44531302693fee30822fad9a23d151fcf818cbad0f3c61b23b1
SHA512811a04594c550ed1337fe9b3e2e5cfdb27b173dfd1cb434e95013fecd51c73ba7c1de0055cdc3c7eb522a1d932b6eed31e115a63c685167fb5b9ddd7d3a9ac70
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
824KB
MD5c367fad7c8678b6a55c4d020c8b97e50
SHA16236e8bfef6ef413bf0d93ba1f4f08d24ff71238
SHA256acc5144c8d744dfd9e4a526f1734b44eb1e5b5db8ffdaed87af917296bacf0cd
SHA5123dbc71c0ad0bd34317f8ccad859755d089fc286c2c3ab6a9434802816e95aac88845a6afaccb27c1c8d1e9a22f32b3b13e82f7a514d2d4e92a51192484c0325c
-
Filesize
259KB
MD5a6fc8ce566dec7c5873cb9d02d7b874e
SHA1a30040967f75df85a1e3927bdce159b102011a61
SHA25621f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d
SHA512f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
848KB
MD5d533c269d1118d2da185fd90fa817c0d
SHA140c9fb5aea843f3eef12ba44334ddbe869ac9722
SHA25645b1b2a76bc3c34c82e6daf4266e76c640c24e27735fcddc861e74aea02c0d61
SHA512c35809784f651acebd5e0fd4c1fb0809e908204a16b6936ba92124ccfa7170783498a33decc67b11cc2d68a64dc2a8bc57750e60afa6aae5b2044df93b3bd032
-
Filesize
1KB
MD57efd75d6a53c1154ff13cc0f9092e26b
SHA1d701657cf78db49b0bc6eab4f1e6a487a4f85af3
SHA256969a1ae928dc1709f90565d8544ba1559bf8913cf9f2db30025ffc23cfae85fd
SHA5124a4735454fe28328b2bdaf1e191db81bb6da56b4e3842b1bcd84e233516099c12f6743f0f467b3aee989f50e0f233d4e12a7c432229efdcf200f5fb885836a66
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
64KB
-
Filesize
820KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
820KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
28KB