Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 13:41

General

  • Target

    1a57158743374e0921da27736bd82f9f.exe

  • Size

    854KB

  • MD5

    1a57158743374e0921da27736bd82f9f

  • SHA1

    aab70a28915715dad73ce093aa0b8cf7a558a860

  • SHA256

    f3238da427c80f842f5b4a789726005ac06157181d80a32105aa639b325d0330

  • SHA512

    cdb5f45bea7052ebcfb5a9484661f8ee7f396a605116c2061fbbd6fc145c734f6bfa7c09705a0536a058a2d186c0101d195320fdca177199b574211af7ffb413

  • SSDEEP

    12288:d137TeVv5IYL6VAO9QQOPv5Gx1MziGqLK49H2dgeYXN1jAt2NjFtOHpF:d1ripBL6VAO9QQ9my9HMy7jAMNja

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u3r5

Decoy

alashan.ltd

demopagephequan.online

garxznql.icu

unetart.com

dajiangzhibo15.com

influencer.fund

beverlyhills.city

strefafryzur.net

giftboxhawaii.com

ecotiare.com

homeandgardenradioshow.com

sageandsandco.com

laflesoley.com

icipatanegra.online

autovistoriapredial.net

xn--polenezkypark-pmb.com

cbdamic.com

aaronandmarissa.com

datasoma.digital

theclosetology.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a57158743374e0921da27736bd82f9f.exe
    "C:\Users\Admin\AppData\Local\Temp\1a57158743374e0921da27736bd82f9f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1a57158743374e0921da27736bd82f9f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3060
    • C:\Users\Admin\AppData\Local\Temp\1a57158743374e0921da27736bd82f9f.exe
      "C:\Users\Admin\AppData\Local\Temp\1a57158743374e0921da27736bd82f9f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1112-13-0x0000000074070000-0x000000007475E000-memory.dmp

    Filesize

    6.9MB

  • memory/1112-3-0x00000000003D0000-0x00000000003EA000-memory.dmp

    Filesize

    104KB

  • memory/1112-2-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/1112-0-0x0000000001300000-0x00000000013DC000-memory.dmp

    Filesize

    880KB

  • memory/1112-4-0x0000000074070000-0x000000007475E000-memory.dmp

    Filesize

    6.9MB

  • memory/1112-5-0x0000000000A90000-0x0000000000AD0000-memory.dmp

    Filesize

    256KB

  • memory/1112-6-0x0000000005660000-0x00000000056FE000-memory.dmp

    Filesize

    632KB

  • memory/1112-7-0x0000000000A60000-0x0000000000A8E000-memory.dmp

    Filesize

    184KB

  • memory/1112-1-0x0000000074070000-0x000000007475E000-memory.dmp

    Filesize

    6.9MB

  • memory/2852-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2852-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2852-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2852-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2852-16-0x0000000000810000-0x0000000000B13000-memory.dmp

    Filesize

    3.0MB

  • memory/3060-17-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/3060-18-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB

  • memory/3060-19-0x00000000026F0000-0x0000000002730000-memory.dmp

    Filesize

    256KB

  • memory/3060-20-0x00000000026F0000-0x0000000002730000-memory.dmp

    Filesize

    256KB

  • memory/3060-21-0x0000000073A40000-0x0000000073FEB000-memory.dmp

    Filesize

    5.7MB