Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    250s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 03:37

General

  • Target

    3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe

  • Size

    3.4MB

  • MD5

    cecde978f0dcdc5b3f713282e6f2c2f8

  • SHA1

    4d9cf78b1ad338bfd367cf4cb22555c44599d411

  • SHA256

    3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399

  • SHA512

    c3057c6a1f0c8d188f2e89ab1c14caff85acb91eb6a7e7231615141d241414dd6b4d7688889acae368721bf5613613ef7ffc875b95de25fbc8d40d5a4fe8aca2

  • SSDEEP

    49152:a2r5FA7K1OopyYq0JunYOfFy0PzqIZG9p6zM7ikvPURaH3XE4hX86tGoWrrKUTdq:7r52zY40My0bAHvsAH//Wrf/kDd

Malware Config

Extracted

Family

socks5systemz

Attributes
  • rc4_key

    i4hiea56#7b&dfw3

Signatures

  • Detect Socks5Systemz Payload 3 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 19 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe
    "C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp" /SL5="$4014E,3304892,54272,C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:2584
        • C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
          "C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2696
        • C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
          "C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2568
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 29
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 29
            4⤵
              PID:2544

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe

        Filesize

        1.5MB

        MD5

        4853d3bd83f7a6ce511ad61d3e00218b

        SHA1

        6d13c8e11308db32acfab565407e043a46a424ef

        SHA256

        c8c087eeb9a417bf8a88612f048d5d9ae6f55717713f5058252edf78faf17dda

        SHA512

        1e0ef797f52cc867ffc19874494eeafca8511a83af3f6d337fd444f2a83a50799662a065d5b233bcf0db2b6b6a432250632102f1e55577e651ffddea7722af86

      • C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe

        Filesize

        541KB

        MD5

        ef7cdf295df7d1f2daf5ccb6ece17fce

        SHA1

        b2a7830cec0da6d88eafc11fcf36ae5466ce9e6c

        SHA256

        75b812cb5a824254458789b17517f13df4d6855e198c31834bf94b7a26196364

        SHA512

        70d0de2c270047ec26984397deff450b8edcc981ddb8aea319de15bedf694470851f963a5f82bff73676559878d2c465ac8129446ab1f857f43fbfafa9f65167

      • C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe

        Filesize

        703KB

        MD5

        327a7a843d449af31d93c6b94063a7b5

        SHA1

        edcabc6def5650c632e861de2b94a4543a793f4f

        SHA256

        602cfb614d4aebfad307523bc68dd8740358e9223ca55a16804031e66416a404

        SHA512

        7f1869644c365fd00cbcb60b22574d53ca807825db61ae5aa08da1a2e753e8e18e680e9b8d21c327120842d619fd927b3368abafd3e201bc36f6ce433696a770

      • C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp

        Filesize

        694KB

        MD5

        5525670a9e72d77b368a9aa4b8c814c1

        SHA1

        3fdad952ea00175f3a6e549b5dca4f568e394612

        SHA256

        1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

        SHA512

        757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

      • \Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe

        Filesize

        1.3MB

        MD5

        6e15db36fd6339866fab14d4cb3e6dee

        SHA1

        adad0dea33b3b2e28acffc0a105c1ff3a241fea0

        SHA256

        430efb495841b82f4ee9f4d31508fc158f816ee029b8bf6142b8f922c51ca11f

        SHA512

        56a3a0f5bc2d4f340df29e64e67753c9f972fa92b8f4d570f4f9df8e3cab30ec9782e1c427325bdb6a17ca1518bb1a2b05cda2cd26ac3e4e379cd3db5afb8ff9

      • \Users\Admin\AppData\Local\Temp\is-KLB57.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • \Users\Admin\AppData\Local\Temp\is-KLB57.tmp\_isetup\_isdecmp.dll

        Filesize

        13KB

        MD5

        a813d18268affd4763dde940246dc7e5

        SHA1

        c7366e1fd925c17cc6068001bd38eaef5b42852f

        SHA256

        e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

        SHA512

        b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

      • \Users\Admin\AppData\Local\Temp\is-KLB57.tmp\_isetup\_shfoldr.dll

        Filesize

        22KB

        MD5

        92dc6ef532fbb4a5c3201469a5b5eb63

        SHA1

        3e89ff837147c16b4e41c30d6c796374e0b8e62c

        SHA256

        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

        SHA512

        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

      • \Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp

        Filesize

        682KB

        MD5

        dea35496a193249d0a4f2b71af5905af

        SHA1

        fc5ac157bc80c7d2f47eb6861d71806d7856f216

        SHA256

        4c891296c741e092c3cdf64caff3f889b1910683c6fa505a89fde4eb1545878c

        SHA512

        e5f1cdc8c121c2315e602a38a389db5b9b6d3d4fce574d4b7818edc0c8502859415625374435c91a677342d26d8e19ec156ea62ecd0cd15281757c1fa86d6465

      • memory/948-9-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/948-62-0x0000000003190000-0x000000000347D000-memory.dmp

        Filesize

        2.9MB

      • memory/948-76-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/948-74-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

      • memory/1972-1-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/1972-73-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2568-79-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-94-0x0000000002B70000-0x0000000002C1D000-memory.dmp

        Filesize

        692KB

      • memory/2568-72-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-140-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-135-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-75-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-132-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-129-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-80-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-81-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-84-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-87-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-90-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-93-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-95-0x0000000002B70000-0x0000000002C1D000-memory.dmp

        Filesize

        692KB

      • memory/2568-70-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-100-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-103-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-104-0x0000000002B70000-0x0000000002C1D000-memory.dmp

        Filesize

        692KB

      • memory/2568-107-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-110-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-113-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-116-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-120-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-123-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2568-126-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2696-63-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2696-67-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2696-64-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB

      • memory/2696-68-0x0000000000400000-0x00000000006ED000-memory.dmp

        Filesize

        2.9MB