Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/10/2024, 20:06 UTC
General
-
Target
4c29136a7c79c79409ce8255d3b6157b4fc08a591220993bb90645f2acac2cab.dll
-
Size
940KB
-
MD5
4087adacea74316cd6099ea4f269c758
-
SHA1
a5d17da00274ea0ce366dd891baca90be38b587b
-
SHA256
4c29136a7c79c79409ce8255d3b6157b4fc08a591220993bb90645f2acac2cab
-
SHA512
f6377700b210cc2503f495a68dc6485ba880c5a88724657b6851c6889be808d2650f77bd3303c0088da2e518d305b2d29797d565dce19502d8cea4c5b52d29ed
-
SSDEEP
12288:EPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:EtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c29136a7c79c79409ce8255d3b6157b4fc08a591220993bb90645f2acac2cab.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\J7bGpwU\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\J7bGpwU\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\njZ\wbengine.exeC:\Users\Admin\AppData\Local\njZ\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\IcNn\Utilman.exeC:\Users\Admin\AppData\Local\IcNn\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5bd801c4e4e0567194c85e42ecdb9dfbe
SHA1707480ee59bcf426656ae563306bf2bbfd8e9542
SHA256d35356c714171b116b466d5584d1edb036b8608737c5d8b36e369d60aa8bb263
SHA512924d4997698dc7b92405503e57c74d5daff0db9bd64f7c37fc2207d17b6a42f48a4adcdb34af61699117609dc3cfec32d92a305063112b3473816d2ebce32699
-
Filesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
Filesize
968KB
MD5099245ec4137218d361151b7566e36ed
SHA1dbb228ada80433313296b44c03c36b662ec446d6
SHA256aeaea80bcff94932fcbb8b9b7944a53cef7e0e6a33b7d0faf370bf474517f8a8
SHA512c8e32941f06ccc2a87f4af51eba1c2fbddc354c98135d8608d1aa2a34f1e1755d3148de542882adb459e9765a7f4ca34f2d82c6e7dda09811aa2b99e7051acc3
-
Filesize
944KB
MD5991aa5a2abcc63479bb0b6f7b56150dd
SHA11204106e6268a418e8cce777ae4ee819a65dd0de
SHA256edb2e73a38178722e6dfeb5aed28ebb4e8af2815c4b647f3aab9820b90ac6966
SHA51242804652b9b23ada05a3aed4c77a64ff5dc2ec84579f6e6f413916c31ab8379791e1e44233be4c5544d0165c6beaa3e4325440f2c177acb06a34918be7a1406a
-
Filesize
1KB
MD5f1fa3cff1898416e1a05851aec51247b
SHA1dc5b00efc0859535ffa86bc1c15c807d30200953
SHA256f8e7163c379fb43e7807c5cbe42e3ddc83d9c96eeb2721325fdc51ffbecb3a22
SHA512af7582895cfc9e2bf34d893c92ca9a6cbab0c243db9e2302468e64cbf06b5283f39ff86590701978e179b98863a65f4b2cecaa22911743922878b3bc17794d5c
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB