Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 06:52
General
-
Target
a4572e7d4e5c1548ceb7216066e8c131a2c41b7717d6ef89f1d43c8e68816b94.dll
-
Size
824KB
-
MD5
afd56972bd23300ceff79144c07af499
-
SHA1
3b28fc603adc5770fecd90803728632de3da95e0
-
SHA256
a4572e7d4e5c1548ceb7216066e8c131a2c41b7717d6ef89f1d43c8e68816b94
-
SHA512
ba1df4f52018052a4382521c05e114bf9e566b22d297e05ef11385ac070c8b458ff8d860b4ffd4f0b620a8ac676623f8de155e264b9cf291bc77aea00ac73517
-
SSDEEP
12288:5Bim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:b/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4572e7d4e5c1548ceb7216066e8c131a2c41b7717d6ef89f1d43c8e68816b94.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\oiJcaaJE\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\oiJcaaJE\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\0Bo\GamePanel.exeC:\Users\Admin\AppData\Local\0Bo\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\RpyZx9\BitLockerWizard.exeC:\Users\Admin\AppData\Local\RpyZx9\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
828KB
MD5594e6d813cd69dcebc61a91ed8f20ac3
SHA1e3d1514e56f1c252b8ce23ea4a4597be4db4ac33
SHA2569c2e1b711af02f6674f9adc176b8c512452fd3cb824002f432b399395044cdd4
SHA5121307e677a0632099256cd302601f77ab9298d861f7385d0d756d1407b8ef3ceb464b8e3a5313a9b628fa7dde590c939bc1a38a1c1fe51c1044465ad0cf18f858
-
Filesize
100KB
MD56d30c96f29f64b34bc98e4c81d9b0ee8
SHA14a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA2567758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA51225471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8
-
Filesize
828KB
MD511572e3d1e6cd623985eb632f8875fb5
SHA13aa3578ad26b16f33a5a436bae5e4084afdb0c83
SHA25630af41879ac94d491c708f34480f0c5cca097df1f7e0bdae3aa8783dfee1f3fb
SHA51289ad5e6428f6ff969eb0a1c5e1f1f1e7db492d4d32d5cc29cdf8d82bc4b51ecc1152afc64b6f545037b05469ead697d918eb37b71bd03d26fba7d7180aeb58a2
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.1MB
MD515b887f57772f8e77d1117c8de39caf2
SHA17df0455ad3a68071158619c78666020a21a8263e
SHA256a824f760f0ff6f03fde778300ac42c699456935044a3c0af4a043124e68f0996
SHA512991ca853d0b0617017ddd2cc2885a94d9a3994ea4abd1b178f52f499b1421a63a0f33320746e4411dc968e6b7a160a001434adab9aa35f264562f40036aae559
-
Filesize
1KB
MD55a0c9575db124f5a3496f1667798de94
SHA16583495787f3d34e9b4cea929180724adb3737fe
SHA2566037d590f9854306ab9a208b20144b2549af5559d9c67332789ee6150ca7ef4e
SHA512de9d68760f2ed3b9d100fa849ab15849da3b53a11e37d289dbe6f4bd1d5f79aaeede5924b2347660adbf2a91ef0cfcffdb69d0fa4c489a9028257b3fdbc98abf
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
64KB
-
Filesize
824KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
828KB
-
Filesize
828KB