Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4265077s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
17/01/2022, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
SearchIndexer.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SearchIndexer.exe
Resource
win10v2004-en-20220112
General
-
Target
SearchIndexer.exe
-
Size
91KB
-
MD5
1cc07a0274718e845c9b77f8334c4cb3
-
SHA1
12b6c08371fd4661ed2da442e7ec34f226d7ac01
-
SHA256
b8fda370e83bf776a2f4c4a23f5d701186e21984f771e878f04fe0136faf1fbf
-
SHA512
0bb60c3a608a6227cfe66f264b2fcdc932e9c9f8f72ff8f8569f23400b6563b8cd834deae1fe4f3866dbef003bbc25372481d6ca8edfcd2467c16a35aa4dfb9d
Malware Config
Extracted
diamondfox
http://timesync.live/panel/gate.php
http://cartierxs.bit/panel/gate.php
http://salamsa.bit/panel/gate.php
http://rockababy.bit/panel/gate.php
http://minon.bit/panel/gate.php
http://bloxfox.bit/panel/gate.php
http://ggbbee.bit/panel/gate.php
http://locksock.bit/panel/gate.php
http://misosoup.bit/panel/gate.php
http://opseckes.bit/panel/gate.php
http://googletabmanager.com/panel/gate.php
cyjJzYyDay1EfrkaW4HRyO6y4OufUKaS
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral2/files/0x00070000000220fa-150.dat diamondfox behavioral2/files/0x00070000000220fa-151.dat diamondfox -
Executes dropped EXE 1 IoCs
pid Process 3144 SearchIndexer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3668 powershell.exe 3668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 3448 MusNotification.exe Token: SeCreatePagefilePrivilege 3448 MusNotification.exe Token: SeDebugPrivilege 3668 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3048 SearchIndexer.exe 3144 SearchIndexer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3668 3048 SearchIndexer.exe 58 PID 3048 wrote to memory of 3668 3048 SearchIndexer.exe 58 PID 3048 wrote to memory of 3668 3048 SearchIndexer.exe 58 PID 3668 wrote to memory of 3144 3668 powershell.exe 63 PID 3668 wrote to memory of 3144 3668 powershell.exe 63 PID 3668 wrote to memory of 3144 3668 powershell.exe 63
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\SearchIndexer.exe' -Destination 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe';Start-Sleep -s 60;Start-Process 'C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"C:\Users\Admin\AppData\Local\xerasr\SearchIndexer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3144
-
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3448