Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
2f79a7faaa1e8d04086b4090f141697c.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2f79a7faaa1e8d04086b4090f141697c.exe
Resource
win10v2004-20240226-en
General
-
Target
2f79a7faaa1e8d04086b4090f141697c.exe
-
Size
2.7MB
-
MD5
2f79a7faaa1e8d04086b4090f141697c
-
SHA1
7bd91b3155571b764c5f64e7a00c31f866f1d83f
-
SHA256
d06a3ee9fa7d2e183950a405ef20020bf4184e98efd7535bd0229de00d2b2d4e
-
SHA512
80cee58a4928f6a020b05bb120e36604ebb66c1f692248be5da188b4553530405b6f1cd9b663fa8a146a10a71a50bc0466f10b3094a5bfd00357bb0403ad442a
-
SSDEEP
49152:C9/cn2d8HF9ybHXQiQvECr6/U05dNiQdnEiezQwWwqV8tB:M/cLnybHXQiivun5dNzdnEiMQwWdVUB
Malware Config
Extracted
socks5systemz
http://beuckeo.com/search/?q=67e28dd86c09f220490efa1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef611c9e794993f
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral2/memory/2980-66-0x0000000000AF0000-0x0000000000B92000-memory.dmp family_socks5systemz behavioral2/memory/2980-69-0x0000000000AF0000-0x0000000000B92000-memory.dmp family_socks5systemz behavioral2/memory/2980-78-0x0000000000AF0000-0x0000000000B92000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 3308 cdshrink.exe 2980 cdshrink.exe -
Loads dropped DLL 1 IoCs
pid Process 3492 2f79a7faaa1e8d04086b4090f141697c.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 3492 2f79a7faaa1e8d04086b4090f141697c.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3492 2f79a7faaa1e8d04086b4090f141697c.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1892 wrote to memory of 3492 1892 2f79a7faaa1e8d04086b4090f141697c.exe 88 PID 1892 wrote to memory of 3492 1892 2f79a7faaa1e8d04086b4090f141697c.exe 88 PID 1892 wrote to memory of 3492 1892 2f79a7faaa1e8d04086b4090f141697c.exe 88 PID 3492 wrote to memory of 3308 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 92 PID 3492 wrote to memory of 3308 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 92 PID 3492 wrote to memory of 3308 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 92 PID 3492 wrote to memory of 2980 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 93 PID 3492 wrote to memory of 2980 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 93 PID 3492 wrote to memory of 2980 3492 2f79a7faaa1e8d04086b4090f141697c.tmp 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f79a7faaa1e8d04086b4090f141697c.exe"C:\Users\Admin\AppData\Local\Temp\2f79a7faaa1e8d04086b4090f141697c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\is-IUC15.tmp\2f79a7faaa1e8d04086b4090f141697c.tmp"C:\Users\Admin\AppData\Local\Temp\is-IUC15.tmp\2f79a7faaa1e8d04086b4090f141697c.tmp" /SL5="$60056,2507591,56832,C:\Users\Admin\AppData\Local\Temp\2f79a7faaa1e8d04086b4090f141697c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe"C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe" -i3⤵
- Executes dropped EXE
PID:3308
-
-
C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe"C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe" -s3⤵
- Executes dropped EXE
PID:2980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5a945a6da059ef1c2363aa3547dfb7ab2
SHA12ba5cbdad15907960b888dd5f2c14f21ac52e337
SHA25657e22a462e68d92b597c28654d7e058c52138884fac8b1f33480ee8912a6ccb7
SHA51246da031da97d04371f622a74b97a099a2846949048ff4df905e3f35a799c43163c8908c3af7f7f0a4fa5ef75d9409f64ffa29c9078c2f70f3d3cb908d24458ef
-
Filesize
2.9MB
MD55de65afc7ae7c73a77c52ed3e8d9d69e
SHA128730206bf567d0a9ceda4acc015f997db4a948b
SHA2564ece3734faec18630fc0f6cc7fab234f6e88b2e6cc193595542bad982f252eed
SHA512ed1bc05e04715f10bd0b023ae83722834b19e7a7bf0c8dda9799b602b16d27c443e9036bdf6fba97e881a4688822385f9be0ec8c59e89a12562efadd1ff561f9
-
Filesize
2.4MB
MD52c361beed58bd92967d1f93784f034c1
SHA1132b002909251d1b0aa23a3f9ec299ada0eb436c
SHA2560aa23d522a3bd8583e07125ed07b4ba19c66dd16a787d5250289b23c71592a46
SHA512e35155faa35004f167eb74c3bb3ed7ef1316d5259a3735e55d30484039b1cd6e042c0b0fc80d75a82b0d95af0b2c0af74fb84de65320931272a29af2f61a3ec8
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
690KB
MD5227526be87fbf4b4932a4f1ed146f82d
SHA18c5e96d4d6a517d1f94d14f2f13095022345ee8a
SHA2567b157795b93dd287cbb24a23220ef262268430bfb657ecd3325c8e4c2d948953
SHA5127d47234899e71db7cc3d2c516baaf820599654b22d82cb11eb3b5c199230021188406717405694c13c676a06e08eae865e81627108c8333c9ced94671d776fb4