Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 06:49
General
-
Target
3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d.dll
-
Size
824KB
-
MD5
6651d9c2fbf38bce55c461d94c2cf433
-
SHA1
133be7fe7e9f7f580df12bccb7f7ae14d1c26fc9
-
SHA256
3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d
-
SHA512
01f284c09ac85fe1dbc2415fed87c48a4b61f5dbadb7ff17cfbe628f1d99202bca9cdabbc413c7c3c6cae87cb0adc0c6f6cd5e0f7182016685b3b61af1630416
-
SSDEEP
12288:dBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:f/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3dffdf9e09ce072d12ff2e1a69fe7aaef98a2bb4728ca08f164be06408acdd2d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\0R1AB7\psr.exeC:\Users\Admin\AppData\Local\0R1AB7\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\xnvoGRrjM\Narrator.exeC:\Users\Admin\AppData\Local\xnvoGRrjM\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\RQWPzXh\ProximityUxHost.exeC:\Users\Admin\AppData\Local\RQWPzXh\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\QdPhB\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\QdPhB\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5870717d7605ff07f0194c9c1a057c18a
SHA169dcf030234e8531208f72eeaeb014f8423714e5
SHA2561d935ef8e2eb5e05d4a1d6fac3d88572e488799d93b54af0736bc3f78980acfc
SHA512fc093dbe6d87e81796a41970cc78ff4af8c506935e7955d6edcc59aefd80be1222341f121e2acb818a3c00033372a8d09737b3c6794736a09acb7ad972c21ded
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
828KB
MD5eee617357a272f23a788683117951e01
SHA1d564dc21a0cf9410046564b9398af2493ff2aa0e
SHA2564c39be249483bd0c49b08c04ecac1d42c0075d0228671a48db45f0d76a8c83ec
SHA5128904bfe37551fbe4bed00570e8a1cc9fa576c802506181186360813146e1956e89aff9d91903703f1131acb3be3ce459a401f7c1acbd5ad1df0b6e880945ff0c
-
Filesize
1.1MB
MD5dca9ee3d17ce58fcdbdfb46c6ed0039e
SHA15b446b25aec534134ec3c2c6388dd0cbe319d1c5
SHA2567dac2796f02f88a02c8ce3da74b30a8eff2abcdb93f988a910b56776ac2f9f46
SHA512543edee1e165164ba3480898ebb267aa60eb898eed4ff0614ef971321722fe6d65c0d7b7a785bfde0bfa784e1a890551acbe0598068550b12a90b3daae24ce83
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
1KB
MD5a26f174241119847c72e6a2fe1175bc0
SHA1857758895a13d830f4e109112201d081b21a1847
SHA2560f15374f0c96dfa74b6400225f5c7cdc85734d907ebaa5bca63f7ccc0bb35cdc
SHA512e3a89d1bc925c45c5550944d030326c959a41b12d37b48985ad6c751c66e2ff5de301bfe5d2a337aae7a79a2d9022ea8cd200be953b9620bccb6abd4d0a04f88
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
828KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
828KB