Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/01/2025, 20:31
General
-
Target
6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8acN.dll
-
Size
768KB
-
MD5
6e095303f4a13d3abc3570c81c9770b0
-
SHA1
51d72095910bcee40e9ca5d3faedf1b3072b5e0a
-
SHA256
6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8ac
-
SHA512
602eccf8d5b16cc78409f912752b594c7d01d0eaa79c7723b491a3c48ee19a5b1885769cecabdced0eccb1f7b045237bd8616b4949e36b09a75616aa0277dc6e
-
SSDEEP
12288:J4vNC4bAo/u7kwVKwtKFjZMrCx1U6RjUEjkxDekdIppEiQ/W+nxtnP4DqMX9z6Vo:J4ld9/EkwVK+KFjZBxJ4PgGnMsMryIxN
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8acN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\hCHG0vb\AtBroker.exeC:\Users\Admin\AppData\Local\hCHG0vb\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\xhps\GamePanel.exeC:\Users\Admin\AppData\Local\xhps\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\MvQnySiVK\tabcal.exeC:\Users\Admin\AppData\Local\MvQnySiVK\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
MD5a9259036e36dd2f5fd12154f429553ab
SHA1dc6968f87eebaa94c1fb1d124b8a743438d48cf4
SHA256d9717f284dfc0703da5474291617534162d06424eaa4ef557ba36b6454c5a5c3
SHA5122bb4f07b3e9ea7ad6d945cfc09fff76b8016e52e6eba48263b6a27ca10ccd61f01eae44f5512ccc92323408d25e1c112eadbf0e977d70b9c3232b65c1439cd7e
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
772KB
MD5c42464d7de884cd1e4dcccab4d8c9bb2
SHA16c6c188d08584775cb18155902bce30bea2a37b8
SHA256cef64e81b7144931fb2007a52e2de1894d261d30050843bde9d3b63eb45a51df
SHA51243fb7205696a3fde39243e43eda0c7bbae7b86e089068847d5b3586730e139f1a96a34143400def3400637fc0306495c1a6e89486d19b128bbf74c9f9de804df
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
772KB
MD544128e70ad7529a438e3e581c0f79205
SHA10ead8cc813e4e4c4bface13c19d6b1946ccf374c
SHA2569c4d80b98fd176650cd4048f37ccca6d0634076de39d154eb7f662eb65c85b8a
SHA51296cbaf53eb8dbce000e5478b71dc8d4e56e79ee64f747ffcc06227a6509002349ad60454b5329ed87c686705235fe82f57440f8c6abef6e2b065763d2e483b34
-
Filesize
1KB
MD531d2af4a416f7672811e52228af5f5a7
SHA1a59b2ccc4de6db834cb800bb6273da6765cb158a
SHA25679d5057a93f4fd263a4566d54479a01eeae571f4838080dfed43a77d5d82b78c
SHA51292485143889a25b1836df4e8919e6832f4aecec64cc39c8cbd6ff60be3fb630626e7cefe786bee40292b7692ad725346ed8f6f422d9e18fa19a62e8e9f03c01b
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
772KB