Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll
Resource
win7-20240705-en
General
-
Target
e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll
-
Size
800KB
-
MD5
252395046102ed9612e50d71bdc56fe5
-
SHA1
23b893ede7e9473b4fdae8051d935ca08593c958
-
SHA256
e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66
-
SHA512
a5cde48eff1e96551d66cae42d8cc88c58efd71bf3ce9da18bdd77c82b285d643c11ffbe55631d22c6e9ecaaa0c45053d74ba46254766c983563704d5d4ba12e
-
SSDEEP
12288:zBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:t/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3356-3-0x00000000007C0000-0x00000000007C1000-memory.dmp dridex_stager_shellcode -
resource yara_rule behavioral2/memory/4488-0-0x00007FFAFC760000-0x00007FFAFC828000-memory.dmp dridex_payload behavioral2/memory/3356-29-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral2/memory/3356-48-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral2/memory/3356-37-0x0000000140000000-0x00000001400C8000-memory.dmp dridex_payload behavioral2/memory/4488-51-0x00007FFAFC760000-0x00007FFAFC828000-memory.dmp dridex_payload behavioral2/memory/4392-58-0x00007FFAED910000-0x00007FFAEDA1E000-memory.dmp dridex_payload behavioral2/memory/4392-63-0x00007FFAED910000-0x00007FFAEDA1E000-memory.dmp dridex_payload behavioral2/memory/3056-76-0x00007FFAED950000-0x00007FFAEDA19000-memory.dmp dridex_payload behavioral2/memory/3056-81-0x00007FFAED950000-0x00007FFAEDA19000-memory.dmp dridex_payload behavioral2/memory/2392-93-0x00007FFAED950000-0x00007FFAEDA1A000-memory.dmp dridex_payload behavioral2/memory/2392-96-0x00007FFAED950000-0x00007FFAEDA1A000-memory.dmp dridex_payload -
Executes dropped EXE 3 IoCs
pid Process 4392 dpapimig.exe 3056 MoUsoCoreWorker.exe 2392 rdpshell.exe -
Loads dropped DLL 3 IoCs
pid Process 4392 dpapimig.exe 3056 MoUsoCoreWorker.exe 2392 rdpshell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jdvukccvumb = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\EJMdXtuifK\\MoUsoCoreWorker.exe" Process not Found -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dpapimig.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MoUsoCoreWorker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rdpshell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 rundll32.exe 4488 rundll32.exe 4488 rundll32.exe 4488 rundll32.exe 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3356 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3356 wrote to memory of 2504 3356 Process not Found 95 PID 3356 wrote to memory of 2504 3356 Process not Found 95 PID 3356 wrote to memory of 4392 3356 Process not Found 96 PID 3356 wrote to memory of 4392 3356 Process not Found 96 PID 3356 wrote to memory of 2644 3356 Process not Found 97 PID 3356 wrote to memory of 2644 3356 Process not Found 97 PID 3356 wrote to memory of 3056 3356 Process not Found 98 PID 3356 wrote to memory of 3056 3356 Process not Found 98 PID 3356 wrote to memory of 4376 3356 Process not Found 99 PID 3356 wrote to memory of 4376 3356 Process not Found 99 PID 3356 wrote to memory of 2392 3356 Process not Found 100 PID 3356 wrote to memory of 2392 3356 Process not Found 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵PID:2504
-
C:\Users\Admin\AppData\Local\66RbyD\dpapimig.exeC:\Users\Admin\AppData\Local\66RbyD\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4392
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵PID:2644
-
C:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3056
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵PID:4376
-
C:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exeC:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5dce004fa7f5c7165f9e31d4637e4604b
SHA1a09035d0d3148112fdaf0fd7f3b9b7832abe3c86
SHA256d545e8d81b4161f91b01cfcdfced0de65bc7b64529aa542639f979e1fec89e14
SHA512c73fa228c2a58df50d85242db2c1df9c690eda65855e2e52138f1e0bf2910d9291b8016e71847ab4be84fa76f547bfb89f0588b24a2d70c7791b8c6ee72c8ea7
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
808KB
MD59f8da0ac7743b2ac9edcaebcbe6d3397
SHA18fe5f6297274ff05c59ed33170142886d1cd6471
SHA256e22154610c677af11743c61fd5e2e8bebb1f4dbd2a0e3ce7d8536b665427b2d2
SHA51286fcedb3675e10de00678868b2db91a3e5092a5119d7d75be882c832e6f2c727a2beab791454f99af3cbfa89fcbd2390c7fb347ed0fd4b264aee940f41e0e186
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
804KB
MD5e8d434bd58232c8cb33bba1771b0f900
SHA17a95a775c3662f69fc095f658fc80625de1804c3
SHA25602246dc3449851a9c7ed7a1e051b897415864759bd5cde6664521d0af8076195
SHA5122732cc0e7d1a1870d99d3f3eaa31f62afa3b25fde06e249380b37b6ff6fd6e687530193e8a7bb0a963b4da6a3ba9078430583ef5a0637ff2d65af795bc0efbe2
-
Filesize
981B
MD5c52be938f70b326b907a81161c3b5f53
SHA14601265cb02a1f7b05a329f26518b6031e1dbf24
SHA256380fa57aa6cab1882c13fc44280535b51a89d334d3f377696816555bffa764a2
SHA512fe1ff6573510afa31c47be9ef8f631bd52038208fa929cf648bd3eb27744fad76bd0afdec3c41f549fac89a30ae332766a4eaee32d4497dfc00c2450ec7ba2bc