Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 19:49
General
-
Target
c3a616358453e48019c7270c1c24c4788acbdbbd17eb1e8882da6670df99b096.dll
-
Size
796KB
-
MD5
7c7ea66ba01a57d19668adafa7292f47
-
SHA1
987fc00ec5d2ec61ecf03b0181f6da93f74a6ab3
-
SHA256
c3a616358453e48019c7270c1c24c4788acbdbbd17eb1e8882da6670df99b096
-
SHA512
68e36af98094c40bf065d80594f1b70b225c42063af6e56532341f0ed0e45c7ef78166b3730c98765880d86b1b704094409aaed05845d7907b21a4d5864a2d00
-
SSDEEP
12288:yBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:e/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a616358453e48019c7270c1c24c4788acbdbbd17eb1e8882da6670df99b096.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\JoeXZmXaz\osk.exeC:\Users\Admin\AppData\Local\JoeXZmXaz\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\X1C\EhStorAuthn.exeC:\Users\Admin\AppData\Local\X1C\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Users\Admin\AppData\Local\JlvEjn\quickassist.exeC:\Users\Admin\AppData\Local\JlvEjn\quickassist.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
800KB
MD55ad824ab5aed9decf6ec63db6b0aafca
SHA18646738830b1c16baeee4050b7bcad6dc1cf64df
SHA25653f96609ef57034b04b8d10c1517f85c617ebf4ba85858650b2a870d6eff7758
SHA512288014b34eb247c01d74d5239390c53b940f206ec5a557850c267630ed60b5ec39ac14fa056249a16ab53d5ba362e6fa44d99c1c9a455727dd7750cd0dddaf76
-
Filesize
665KB
MD5d1216f9b9a64fd943539cc2b0ddfa439
SHA16fad9aeb7780bdfd88a9a5a73b35b3e843605e6c
SHA256c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2
SHA512c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567
-
Filesize
800KB
MD58bdf244691e608f6aa7746da9d76b8e3
SHA1287f3d5d818ece015daccad033140b9a58672a74
SHA25663fb4dd1c59dd09a29e4878d1fa9e7e18e40dfba1b05a8fc789c83c93333b7a2
SHA512d36d90f2e2d47d47f13465574f19caa436484f5a46a2c8ad74ab3f57c30d665a5201e9d53ea7222e192d5c20ab349a38038809294c3a70544f16692adf2595ab
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
800KB
MD59cd0f5e5b9a8f18854b4a538c53d7ad7
SHA19d112c5af64a9ae36b93242682f068d6107ae3b7
SHA25643fd94368a660534871285e8b0a5a573984ed28ad61f93d86418e0f89f138f79
SHA5122e4bd2a55a80290b6f6178d2d4b142e44e44f7c8475e8872adc4cd8dbc977cec63f8caeeab866932e58ac52505a10588d2ab0a50197aae95d085c35b5c0fadb3
-
Filesize
1KB
MD5b9f731fb04d6eb2da25f81fd6b57b5db
SHA162913b8f30e1179bf1c4ffe8690371027c2beff5
SHA2564c995c960b9bdcd73be75a88ba63d04576be450f254096825d0b49a9c269f9e5
SHA5125635f99ef9db36ca16174ed7c2e4b5a99aa4a039f2a80aa3cbb701783e097671d08c424a26148618816ae797ad8697b971530361ae320a65a7e25cfeef00740a
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB