Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/09/2024, 22:56

240909-2wsgjavbpp 10

25/05/2022, 22:24

220525-2bc64sabbj 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25/05/2022, 22:24

General

  • Target

    see7.exe

  • Size

    574KB

  • MD5

    1ccf28645e2d52556487a9710de54d8e

  • SHA1

    e83b5b14a3d08d8838e23c08070ebec713f859ef

  • SHA256

    513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

  • SHA512

    5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\see7.exe
      "C:\Users\Admin\AppData\Local\Temp\see7.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Local\Temp\see7.exe
        "C:\Users\Admin\AppData\Local\Temp\see7.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2036
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:1932
      • C:\Windows\SysWOW64\cmstp.exe
        "C:\Windows\SysWOW64\cmstp.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\see7.exe"
          3⤵
          • Deletes itself
          PID:524

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1268-76-0x00000000066A0000-0x0000000006786000-memory.dmp

      Filesize

      920KB

    • memory/1268-68-0x00000000041E0000-0x0000000004290000-memory.dmp

      Filesize

      704KB

    • memory/1756-56-0x0000000000610000-0x0000000000628000-memory.dmp

      Filesize

      96KB

    • memory/1756-57-0x0000000004970000-0x00000000049E4000-memory.dmp

      Filesize

      464KB

    • memory/1756-58-0x0000000002050000-0x0000000002082000-memory.dmp

      Filesize

      200KB

    • memory/1756-54-0x0000000000890000-0x000000000092A000-memory.dmp

      Filesize

      616KB

    • memory/1756-55-0x00000000750C1000-0x00000000750C3000-memory.dmp

      Filesize

      8KB

    • memory/1868-75-0x0000000001EA0000-0x0000000001F30000-memory.dmp

      Filesize

      576KB

    • memory/1868-74-0x00000000020E0000-0x00000000023E3000-memory.dmp

      Filesize

      3.0MB

    • memory/1868-72-0x0000000000090000-0x00000000000BB000-memory.dmp

      Filesize

      172KB

    • memory/1868-71-0x0000000000860000-0x0000000000878000-memory.dmp

      Filesize

      96KB

    • memory/2036-59-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2036-66-0x0000000000BF0000-0x0000000000EF3000-memory.dmp

      Filesize

      3.0MB

    • memory/2036-67-0x00000000001D0000-0x00000000001E1000-memory.dmp

      Filesize

      68KB

    • memory/2036-65-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2036-62-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2036-60-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB