Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
17/07/2024, 06:49
General
-
Target
3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d.dll
-
Size
824KB
-
MD5
6651d9c2fbf38bce55c461d94c2cf433
-
SHA1
133be7fe7e9f7f580df12bccb7f7ae14d1c26fc9
-
SHA256
3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d
-
SHA512
01f284c09ac85fe1dbc2415fed87c48a4b61f5dbadb7ff17cfbe628f1d99202bca9cdabbc413c7c3c6cae87cb0adc0c6f6cd5e0f7182016685b3b61af1630416
-
SSDEEP
12288:dBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:f/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\3KfLYW\rekeywiz.exeC:\Users\Admin\AppData\Local\3KfLYW\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\IJICFO\raserver.exeC:\Users\Admin\AppData\Local\IJICFO\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\12d1jd\mspaint.exeC:\Users\Admin\AppData\Local\12d1jd\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5082d2e35a838816c5f4f5b9f0e813f44
SHA13bf849cdddbfe2edb5588818ac60700a713e48c7
SHA2564f65538894d0c00002dfb15692676938d4e072e01c0c1ea6c887fc7d0da7d652
SHA5124167472a54080169730a5cb3ccd8bb2a4e00dc33abe7a68e62e12d15f77a6a23b8fdd2bf282962bd12aed539500373bac966cdb10d9b94cf35ffdcaf6d55507f
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
828KB
MD5d9cf7e4fd97f7c27b97c504ad0a890e6
SHA1dc2d33e08b1fa5351383dc032dcdfef6594a70d7
SHA256689c70433f69ad587605e325127bf8fbd2d8fd75c2d3bdcb5cd772ba18123829
SHA51212ff2aa736b5ea23839b03d6bc099b17a0d43359bf71430e57c1f12d0253b046220c15099ca71bb8daf09b1410eafbfd65c1358b2ef6d87c1780903dcfacad56
-
Filesize
828KB
MD541d476e55526a079a2fee5936ee3b4c1
SHA16b102bf6edbb87a5a83d9f60d08313b890ae1b17
SHA25644d7b6685c6151315373a96c66f51837f1f351a6008c224224705f3d6b680e4b
SHA512e2e0228fd22e37f916674b0782609596dd3154644442353c64ca520bb3cc464d673c3a3c1e0fa781f9ae6d82185217a6face5d2c029263cab353f383c91036d8
-
Filesize
1KB
MD5d1335fa3e50e343af1fe4f71655b447c
SHA181a766ce8ba5850c13392c5981480f02cc69d4bd
SHA2565b08d38f31d8537909a9b451637a55767f0a7d9c30fea1c9f5e0b9d559fe35ca
SHA512c77b16bb1f0ef0b4a2b702e799351aa9e299543cfc060f8a5b67caec26ad75dbbc19ada8abcd95896e0f33a99b95c5b9931f37b0036eb50592a9b15cb12265f5
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
8KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
8KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB