Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 02:07
General
-
Target
96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9.dll
-
Size
672KB
-
MD5
f4ad23ec7d76d48355a204d4cca86bb9
-
SHA1
21cc90073ea6b2e99f535272e4ec2127c6dfd4c3
-
SHA256
96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9
-
SHA512
bdf9ff9cea9d581d4f81524e720985ff82f52ed10267410c43cbeeae018afb2b5b0708d7666393df02284e08736060e124beba414de4a5648a91f6c952f3ab7a
-
SSDEEP
6144:U34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:UIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\0BKvyuG0\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\0BKvyuG0\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\O32Z1k01\rdpclip.exeC:\Users\Admin\AppData\Local\O32Z1k01\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\6bIx4WVu\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\6bIx4WVu\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD52f96a864f74746a7a520978eac51354e
SHA144f75f77b85fec8816534588a3dffd0145d9ab2b
SHA256af77151a592c80be598cf3b735b3ed042676b1b9a7060d34c4fb67ca192e4bf8
SHA5129425f2c9d4dd3d96fac3daf9998536facab5cc49126437a4b77a0f5b6552cb1e7c13340291ef3005c86fc9955c0db25b74c9ccf21c1be1d00fdf1928cbe8ce85
-
Filesize
506KB
MD550adb2c7c145c729b9de8b7cf967dd24
SHA1a31757f08da6f95156777c1132b6d5f1db3d8f30
SHA256a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec
SHA512715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0
-
Filesize
952KB
MD5cccb30a0c9d49a4fa36d387ef0c27615
SHA11e57b46aa373b8c1410b598dce1068ea7e636cb5
SHA256c1c2e05640a8fd02a11be8a77ca913b11e0354272bf097fcc4d87fcdb519549e
SHA512d970d5d13ddec1cd278d2896cc8a809adf5c696fa548ce5edef1b913153b0731d304cf18f1d0f76009b45ad7dee474c94b3593239864b0171cdbfec38055af8a
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
676KB
MD569dd31fef4839e00ee53cb61581646e4
SHA10480edf1354bc82e0812d8a58844d9975880ffe4
SHA2563bd5f1f77780ca947fe552f9c0d8f073f61a27852ee396d39fee9d7a33d5cfb8
SHA51252f2bc93c604cfa5c35185255acd05f3878379bf82c9b80e92522b54c535c27a201731c6b966fa95800025769e315217d4892a7839385eeba3206327a205702a
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD5e64cf364b80b5574790c5e44c70ab6f4
SHA1468dfae9bbd9bc1c478d639dcbf631fe6a4b5073
SHA256aacbda0da079589405624c87818f66e3e1d4f2081f6b6677bf5ad1f3d97d45e4
SHA51244368a1454b84411d9f95cfe5ca219c25b007faafa4ae64a7b634d18fe1f9be59d7c5cad68a9f0cf88a26fdc95ee895c806f9eeaac13e2ceec431d8b03ae1c89
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB