Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
17/07/2024, 06:49
General
-
Target
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll
-
Size
800KB
-
MD5
844f37f59e5af38fca800fb75c94a4b9
-
SHA1
8505caf8264a9a1cdd9a6f6cba608ef01e38a2d9
-
SHA256
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c
-
SHA512
7c3130224a823be7271e9489497c979bae68836c3779f0028325a245ff2138ef21870c4d84fb1d7f8943a1bc1f497a2d63d95aeb8bb6a6893ad00fc4d4f55b7d
-
SSDEEP
12288:hBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:j/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\5zKW062O\SoundRecorder.exeC:\Users\Admin\AppData\Local\5zKW062O\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\Cm5\msdtc.exeC:\Users\Admin\AppData\Local\Cm5\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\CfRRubSSM\sdclt.exeC:\Users\Admin\AppData\Local\CfRRubSSM\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
808KB
MD5148dc0ea1dab5d265450d5c73520cfa7
SHA1acbd9e2daad22c7097468002dc7e0a2f96be3bce
SHA2565dfff264426d0481e738b99b0d93dfffb3650ea90a073b09cb4e5443bc09336b
SHA512d0cec2e40a517c696ab5f66567e809c9655c2b6133949ed74136028a7544a0cc35424e9676e9d8afd72e0864795ddc0db8ae8fb952cc255e05a39dae89f4d5b6
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
1KB
MD57efca1547a243d166dec69af6c0cfb5f
SHA1c0f9cf2a31c94c33fc844421b850bf5d3dcb99e7
SHA2561532d4486caf540e4258ffe149703c187107fa46bd1a158cd29e11b5a0a4132d
SHA51240822a941acc2b46645cec8dcd093631f96dcb1667a66b2a8df0c64aa888572f321a1356db0a214352afcaafe0ac98d3cc3f6a88255dcfff8bb7b60cbe187b9e
-
Filesize
804KB
MD5e3abb9a7702511d10f6ffabcfa8323ce
SHA181df2a589f1a7cd309ca2c6cd6e6faf3ddfade14
SHA25635f8b246e3a9988194c01f546e994fff8e32df2c14423da48c5d12213c16728f
SHA51278b0555312a000d0445c73267f521cc479265d284d0a9b7046e24a8dc2538f1d75072a755388de0e2047f485a6b2c626285162bcead35da02be2284e8d9bbd8c
-
Filesize
804KB
MD5bb5e1c3b06fa2459ede00d0787913bb9
SHA1709b260c3f464b4c26cd4a2a3d03104c9d5f0b99
SHA256cf50eafbaebc4ab98cfbf18a8db782d56e069e781f97ece3fef5fa9aa3374abd
SHA512aec8d09f5de5c97424501292c5086c68e9b50ed83882ef604165bac5e2370b0b5c82ebfd8033799d126f9b5d337fadb9eaaf79d30b34bd7515a568b7854f7374
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
804KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
808KB
-
Filesize
808KB