Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/01/2025, 01:07
General
-
Target
5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93.dll
-
Size
788KB
-
MD5
57ff8aad6421b8785d191a75825a457d
-
SHA1
7991ebfc143d958342135a84297ee949ef110f2a
-
SHA256
5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
-
SHA512
ec22ac2a7f68eb08b253a75efa75ca5d7dda6c726bc24f799556dd88f1347066c9a36ee683c8e77fef0cc42b0a86c4cbd6caabcf432134b63e815601b76fb908
-
SSDEEP
24576:9WyoyFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:oSuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SnippingTool.exeC:\Windows\system32\SnippingTool.exe1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Local\jMAy\SnippingTool.exeC:\Users\Admin\AppData\Local\jMAy\SnippingTool.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\3uEU\usocoreworker.exeC:\Users\Admin\AppData\Local\3uEU\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\F7Y4W\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\F7Y4W\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD58e3a487adf5d74f741e55b5b23df64cc
SHA15c00dfa9bf6685fcc699e913c2b405d5838f1cf1
SHA25637fd0d5d9da821bee5c401869b2325c611a76cd58359e9fdaf83dcb3af0ade96
SHA512db826cfd03b9233b3f27553c660e7fd3d30aa9d2161649553cfa07d76c4ed3c3cc480f9ec348b7c08f3e0d7653b45f8fc180ba939dfe3f173f559acd940f151c
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
792KB
MD53ea5ea84e6594532dee007c88eda891c
SHA1ac546fdf429937ef51d52df97562f0b230e1d06d
SHA256fa1366d1fbe9c74fa8ab847db085de744d1f38bb14e48a0f80aa0bfc70292744
SHA512a3dcb18747620b58f77c6048b2b0181b780323ab0e3ec9449c226fe52793d2b93cb28d06e954f943cc3d30aac98de60a0cc3ef7ec86dc032290d86139c5faadc
-
Filesize
792KB
MD532ca4baa605f6d2e941fa448a82e2b50
SHA118e5cd361a9566bd65b1187ca0336325a12eacf4
SHA256f7b3f21ac8cefaf6bd37be30ae3ef2517311bdf6832a9affee34d74a464fc57f
SHA51236d7447cde19c7600f7e5b13a9641cf2089f820e078ad7ae5814e3ec1a96f0c5f197f2e83ac354303563f4c275a6d36979e406d26447336cf5fc89db5ccda786
-
Filesize
3.2MB
MD5f06d69f2fdd4d6a4e16f55769b7dccc1
SHA1735eb9b032d924b59a8767b9d49bdb88bed05220
SHA25683be001996cd4d9e5a1a8cd130e17e5b5ee81c9b5cf1b9d9196d8a39fbf7506d
SHA512ccc1bff59636e91763659749d67b9f6255765ed5aed4b40b6f8111d4136a7e2fe9e0726396b0c837e4ab8717528134273ffc0825a205e501a13bf1d3aee5046b
-
Filesize
1KB
MD5bd08e6dec829938e7b01678ee96a5345
SHA1c4935a3a0f389c24ad3339289e8dcc1f8a5a53dd
SHA2563b023a2dd41c6ea974828685d7e2299dbd97a26af24a5fa4b3dad97aede221d7
SHA512d476a4b258cbb068cdba1a879707d5e1a70437f5962393e4f2a3752772325c52daf43c907e201f3a664e6fca05285e0b926c93a352a8ef18d394c6cab0281c08
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
792KB
-
Filesize
792KB