Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/02/2024, 17:26

General

  • Target

    2f74d868692ce50e073cfdd6a2fbafa3.exe

  • Size

    2.4MB

  • MD5

    2f74d868692ce50e073cfdd6a2fbafa3

  • SHA1

    7e31e58f97728181a239583884cd6789e5ddf891

  • SHA256

    c237d3d7c79c5fb7795b875bd6f6c79e5bc95a96d41cf4249d755427dc4c1d58

  • SHA512

    811648978e206e396c790dca0bf61fd161711ed682842a6f95e4e2619e55a445078e56ff3c749ed1bd1e745c952276381029596e5b3d23a3415440b622279beb

  • SSDEEP

    49152:C9Poy707ePYSmuZMJdIdF/+zVQn/IZjjNf2UwcMyPOJPca0o83hlurCT:MAKbGcdFmVQn/IZjjfwcMyPGPcflH

Malware Config

Extracted

Family

socks5systemz

C2

http://csgkybv.net/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e8efa15c8ec9c

Signatures

  • Detect Socks5Systemz Payload 3 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f74d868692ce50e073cfdd6a2fbafa3.exe
    "C:\Users\Admin\AppData\Local\Temp\2f74d868692ce50e073cfdd6a2fbafa3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\is-NT5R8.tmp\2f74d868692ce50e073cfdd6a2fbafa3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NT5R8.tmp\2f74d868692ce50e073cfdd6a2fbafa3.tmp" /SL5="$7011E,2127575,56832,C:\Users\Admin\AppData\Local\Temp\2f74d868692ce50e073cfdd6a2fbafa3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe
        "C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2608
      • C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe
        "C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe" -s
        3⤵
        • Executes dropped EXE
        PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe

    Filesize

    261KB

    MD5

    f9b3bdd8a2fe73e500031aeb0bd38b86

    SHA1

    82be033ef07bd3e15187f207eeab8d67fb304231

    SHA256

    8efb72cdbcb654225e0bc074c2ff8f7463ecf64e118675fa68a39fa7c6282bc9

    SHA512

    9f90cebc6b188adb8b559e5e0ea9e2439e1551c4149826ef7412551e0434a07639743f270df656065d693b904a6c5c963361c53daea7da00d8f7d8c55a8d1463

  • C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe

    Filesize

    1.4MB

    MD5

    d14f9ba39f00c4ec56bb04bd4afda749

    SHA1

    8ccb3b28a2ea191b7db0dd794efcc095bf3a76fb

    SHA256

    a966f1387176c2218590286e042f6a424a8ac3825ffc412b5e474e3a69cb98e8

    SHA512

    6a229742550bd180dba98ff99d382a9b0d95eea9f32306a47f31327100b5e89d6137c6fdb4c82d952723747f33564ea574a3b15864bc82b7c406ae7ee198787c

  • C:\Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe

    Filesize

    22KB

    MD5

    23038ab2b61c443ad9cf4a5329507891

    SHA1

    f2a2b27c4c6b428908185b15ce1fae7dc2b062c0

    SHA256

    ea1ea36cac88d56f1054cfb07b1bd8e57862c66daf2e567fd632e4f3d6e5bb46

    SHA512

    d1ffea809a38b1b62d66171fb2309285a4b1122919e10f28693ffdc4570ed5df0dc24a4e8117fa6c338e55f2cc8ab0a044e21c009fe290b69317b8069e791e15

  • \Users\Admin\AppData\Local\Sadko Drive Speed\sadkodrive.exe

    Filesize

    1.1MB

    MD5

    c717f02ff192f6d6a55d88b6535439c7

    SHA1

    1d6d47f592a0a67a6324cbf3abdec7bd2960074a

    SHA256

    dfdb5bdbe78f1b430cdb7aec158ec7b698c6bec067409bcc35c53f14f0596f02

    SHA512

    49e77201241d21501b15844040ed4bc4fdb8206250a4c39d587e678c468fb8cc69560bc91288e46e56a9a5144d2ab50d5bb93a1391991bbd3226694d862a183b

  • \Users\Admin\AppData\Local\Temp\is-MUVB2.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-MUVB2.tmp\_isetup\_isdecmp.dll

    Filesize

    19KB

    MD5

    3adaa386b671c2df3bae5b39dc093008

    SHA1

    067cf95fbdb922d81db58432c46930f86d23dded

    SHA256

    71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

    SHA512

    bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

  • \Users\Admin\AppData\Local\Temp\is-MUVB2.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-NT5R8.tmp\2f74d868692ce50e073cfdd6a2fbafa3.tmp

    Filesize

    690KB

    MD5

    a4a2a684c1454484e5b95a81c1bd1b34

    SHA1

    fcb5a95d4847a296f938a0f2e1b2d286d8c728a1

    SHA256

    6155c75f1b12a43374733984467f26adaf930b8b5c56e2986e3da0ffdcd13653

    SHA512

    7c9866bdb41e06de09a805efce06a6a2bcbea544f9dc7834c716d4ae7d15f413283782ec17a158aa8b35e247f20622fb65f803cb5c000820c164627ece5f9aef

  • memory/1152-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1152-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1272-44-0x00000000037E0000-0x0000000003B0D000-memory.dmp

    Filesize

    3.2MB

  • memory/1272-59-0x00000000037E0000-0x0000000003B0D000-memory.dmp

    Filesize

    3.2MB

  • memory/1272-58-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1272-7-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1272-56-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2608-45-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2608-47-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2608-46-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2608-50-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-72-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-76-0x00000000026D0000-0x0000000002772000-memory.dmp

    Filesize

    648KB

  • memory/2728-52-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-62-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-65-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-66-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-69-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-54-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-75-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-57-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-77-0x00000000026D0000-0x0000000002772000-memory.dmp

    Filesize

    648KB

  • memory/2728-83-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-86-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-89-0x00000000026D0000-0x0000000002772000-memory.dmp

    Filesize

    648KB

  • memory/2728-90-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-93-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-96-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-99-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-103-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB

  • memory/2728-106-0x0000000000400000-0x000000000072D000-memory.dmp

    Filesize

    3.2MB