Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/07/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll
Resource
win7-20240705-en
General
-
Target
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll
-
Size
800KB
-
MD5
844f37f59e5af38fca800fb75c94a4b9
-
SHA1
8505caf8264a9a1cdd9a6f6cba608ef01e38a2d9
-
SHA256
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c
-
SHA512
7c3130224a823be7271e9489497c979bae68836c3779f0028325a245ff2138ef21870c4d84fb1d7f8943a1bc1f497a2d63d95aeb8bb6a6893ad00fc4d4f55b7d
-
SSDEEP
12288:hBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:j/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1344-4-0x0000000002630000-0x0000000002631000-memory.dmp dridex_stager_shellcode -
resource yara_rule behavioral1/memory/2500-0-0x000007FEF71F0000-0x000007FEF72B8000-memory.dmp dridex_payload behavioral1/memory/1344-38-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral1/memory/1344-30-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral1/memory/1344-51-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral1/memory/1344-49-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral1/memory/2500-58-0x000007FEF71F0000-0x000007FEF72B8000-memory.dmp dridex_payload behavioral1/memory/2580-66-0x000007FEF72C0000-0x000007FEF738A000-memory.dmp dridex_payload behavioral1/memory/2580-71-0x000007FEF72C0000-0x000007FEF738A000-memory.dmp dridex_payload behavioral1/memory/688-83-0x000007FEF67C0000-0x000007FEF6889000-memory.dmp dridex_payload behavioral1/memory/688-88-0x000007FEF67C0000-0x000007FEF6889000-memory.dmp dridex_payload behavioral1/memory/2452-101-0x000007FEF6A10000-0x000007FEF6AD9000-memory.dmp dridex_payload behavioral1/memory/2452-105-0x000007FEF6A10000-0x000007FEF6AD9000-memory.dmp dridex_payload -
Executes dropped EXE 3 IoCs
pid Process 2580 SoundRecorder.exe 688 msdtc.exe 2452 sdclt.exe -
Loads dropped DLL 7 IoCs
pid Process 1344 Process not Found 2580 SoundRecorder.exe 1344 Process not Found 688 msdtc.exe 1344 Process not Found 2452 sdclt.exe 1344 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nvzakw = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\ovKtwMRHVg2\\msdtc.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SoundRecorder.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msdtc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sdclt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 1344 Process not Found 2580 SoundRecorder.exe 2580 SoundRecorder.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1344 wrote to memory of 2848 1344 Process not Found 31 PID 1344 wrote to memory of 2848 1344 Process not Found 31 PID 1344 wrote to memory of 2848 1344 Process not Found 31 PID 1344 wrote to memory of 2580 1344 Process not Found 32 PID 1344 wrote to memory of 2580 1344 Process not Found 32 PID 1344 wrote to memory of 2580 1344 Process not Found 32 PID 1344 wrote to memory of 2628 1344 Process not Found 33 PID 1344 wrote to memory of 2628 1344 Process not Found 33 PID 1344 wrote to memory of 2628 1344 Process not Found 33 PID 1344 wrote to memory of 688 1344 Process not Found 34 PID 1344 wrote to memory of 688 1344 Process not Found 34 PID 1344 wrote to memory of 688 1344 Process not Found 34 PID 1344 wrote to memory of 2624 1344 Process not Found 35 PID 1344 wrote to memory of 2624 1344 Process not Found 35 PID 1344 wrote to memory of 2624 1344 Process not Found 35 PID 1344 wrote to memory of 2452 1344 Process not Found 36 PID 1344 wrote to memory of 2452 1344 Process not Found 36 PID 1344 wrote to memory of 2452 1344 Process not Found 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵PID:2848
-
C:\Users\Admin\AppData\Local\5zKW062O\SoundRecorder.exeC:\Users\Admin\AppData\Local\5zKW062O\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2580
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵PID:2628
-
C:\Users\Admin\AppData\Local\Cm5\msdtc.exeC:\Users\Admin\AppData\Local\Cm5\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:688
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵PID:2624
-
C:\Users\Admin\AppData\Local\CfRRubSSM\sdclt.exeC:\Users\Admin\AppData\Local\CfRRubSSM\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
808KB
MD5148dc0ea1dab5d265450d5c73520cfa7
SHA1acbd9e2daad22c7097468002dc7e0a2f96be3bce
SHA2565dfff264426d0481e738b99b0d93dfffb3650ea90a073b09cb4e5443bc09336b
SHA512d0cec2e40a517c696ab5f66567e809c9655c2b6133949ed74136028a7544a0cc35424e9676e9d8afd72e0864795ddc0db8ae8fb952cc255e05a39dae89f4d5b6
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
1KB
MD57efca1547a243d166dec69af6c0cfb5f
SHA1c0f9cf2a31c94c33fc844421b850bf5d3dcb99e7
SHA2561532d4486caf540e4258ffe149703c187107fa46bd1a158cd29e11b5a0a4132d
SHA51240822a941acc2b46645cec8dcd093631f96dcb1667a66b2a8df0c64aa888572f321a1356db0a214352afcaafe0ac98d3cc3f6a88255dcfff8bb7b60cbe187b9e
-
Filesize
804KB
MD5e3abb9a7702511d10f6ffabcfa8323ce
SHA181df2a589f1a7cd309ca2c6cd6e6faf3ddfade14
SHA25635f8b246e3a9988194c01f546e994fff8e32df2c14423da48c5d12213c16728f
SHA51278b0555312a000d0445c73267f521cc479265d284d0a9b7046e24a8dc2538f1d75072a755388de0e2047f485a6b2c626285162bcead35da02be2284e8d9bbd8c
-
Filesize
804KB
MD5bb5e1c3b06fa2459ede00d0787913bb9
SHA1709b260c3f464b4c26cd4a2a3d03104c9d5f0b99
SHA256cf50eafbaebc4ab98cfbf18a8db782d56e069e781f97ece3fef5fa9aa3374abd
SHA512aec8d09f5de5c97424501292c5086c68e9b50ed83882ef604165bac5e2370b0b5c82ebfd8033799d126f9b5d337fadb9eaaf79d30b34bd7515a568b7854f7374
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3