Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/10/2024, 00:11
General
-
Target
cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c.dll
-
Size
980KB
-
MD5
2f7056cdf2abb1bc979d8c4ebf8ab217
-
SHA1
aca864752fe83b828993a8f4c03ec0b80f13254e
-
SHA256
cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c
-
SHA512
b6cc46f3abd4164b759ab0f777e04412a5df96a2c81f946b5ccd7d47409c8ab91d75f58804311516254f7965d0547803a2840b182292576f18d2a932fb1a410d
-
SSDEEP
24576:qEwXnOAx5HcDM1Sxd3ChCHg2/P9yGoch:dbM1SzCoZ4Gdh
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\Yiy\bdechangepin.exeC:\Users\Admin\AppData\Local\Yiy\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\9rwS\AgentService.exeC:\Users\Admin\AppData\Local\9rwS\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\MsW\ddodiag.exeC:\Users\Admin\AppData\Local\MsW\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
MD563c65a3619599a4b4b2ce3b15f7e99e5
SHA148e95600081c2c9260c046e641c345e520730448
SHA256cdd9565c24f95e5bbd50c5a824a0a0e3b483c3ae79541f7600c5ff97e1f6ee21
SHA512d52d419b21050bc11c7a83dc8a42194513738a1d239042e365e26bfa6b73be3140ca8ca28d4bff7c82f2a3804284d360308aa2d3233c904241de2e39a0261bc7
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
984KB
MD5da20903a2151596dc1a73055289fb4e0
SHA191ec89c89d16eac8fc2e11c629a72c04c990ba2a
SHA256c78f27d7348ba6e7ba4078c2435ff3344037a17d12b2199b02e59d5e6ccd8a61
SHA5129d9694d3d3d1ab82de8de149313af26e0128007c371e05f540b4dcccc8e82802f4f165657d320c69d003b67164e2453ee2a9dcd5bcf434d2820295bb6fe3650e
-
Filesize
39KB
MD585feee634a6aee90f0108e26d3d9bc1f
SHA1a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA25699c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff
-
Filesize
1.2MB
MD5d6c78ee6052b94f6516799b79a0a1b66
SHA1946c874678c11f837a157c170a9b3f49958a5b47
SHA256d17b64858b9790b8257f8348134271598f540bdb8416b9cf86172b79f2c77825
SHA512de605dc7dce0c2c92ca73c9676ed133ad0ca3179d064a54e5ee5e7a33c914f31b7e6db080d624e88406a8f60af6b00333263ac1256a0e08d7bbdaa190ffa690d
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD5d0ee6a3661f1b7ba7235b0e782384311
SHA1e255a02ad4918c2142b00a2a53abd9f444c4e230
SHA256a108f006bf8d9b1641bf5582401bbf89484f54c1ce04b3d876a906f9a1ce48ce
SHA512184a47336db7ace70d276233788e3ea1d367c15a1c0476b3b6c88777950313ecc491d0ea1a71409698f13ffdcb28a1794cfba84ba3d282e1bd23b208c7ba696b
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
980KB
-
Filesize
28KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
4KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
4KB
-
Filesize
980KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
28KB