Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/02/2025, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
Dryppets.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dryppets.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250207-en
General
-
Target
Dryppets.exe
-
Size
1.1MB
-
MD5
411efb6f23470867166f3990dbec6dad
-
SHA1
e9bb0868d4507c7b55dd048ee9662884cf7657b6
-
SHA256
68570e404a256774e77174fefe7dbec3fe0d49f38bb912ab9263ee579d259082
-
SHA512
7be032a3c1e0c85e57ae30d5ee856fb428dd6ed52f74ec21b1dc311068e09747ca8de02209f2393f1e73f4ec0bf700beb179f8424ec5b9853b9e37eab88f6fc3
-
SSDEEP
24576:iV8oSs6OQjptmgUy/QEw6wbfqiPACOedfHYNXNHA6w:iV8Nsm3XQEw3/ACOdHAj
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 3012 Dryppets.exe 3012 Dryppets.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Peppercorns241\septobasidium.ini Dryppets.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2892 3012 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dryppets.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2892 3012 Dryppets.exe 31 PID 3012 wrote to memory of 2892 3012 Dryppets.exe 31 PID 3012 wrote to memory of 2892 3012 Dryppets.exe 31 PID 3012 wrote to memory of 2892 3012 Dryppets.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 4802⤵
- Program crash
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51