Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/04/2024, 14:24
General
-
Target
e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.exe
-
Size
4.2MB
-
MD5
bfab5648e5a967b4ca294eb858e64367
-
SHA1
bbc978ce56fc03c1e4ee99e880f911852512711b
-
SHA256
e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712
-
SHA512
a2d814e442f9d5a535e74b1c23858eb64a4637692958fc7b879fb2e384e9fbafb514dec9aed01c67336f17e40df90f33cdb48080da61c9f9ad3309fedef62c88
-
SSDEEP
98304:CODIgEF4Nev9qqd0VrlEa1X5XX4FJ4BCw3I62MCJdQxbhq:NuqeAVD1pXX4r4BCuoFdQjq
Malware Config
Extracted
socks5systemz
http://buimwdy.com/search/?q=67e28dd8655aa729110daa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffd12c2e8949d33
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.exe"C:\Users\Admin\AppData\Local\Temp\e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L4B3S.tmp\e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.tmp"C:\Users\Admin\AppData\Local\Temp\is-L4B3S.tmp\e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.tmp" /SL5="$701C8,4085430,54272,C:\Users\Admin\AppData\Local\Temp\e5a8065145268e421965ba36bd4218617816f6753630e30e96ab1c2a5a02b712.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Disk Settings\disksettings.exe"C:\Users\Admin\AppData\Local\Disk Settings\disksettings.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Disk Settings\disksettings.exe"C:\Users\Admin\AppData\Local\Disk Settings\disksettings.exe" -s3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5e413dd87c9c4d33e418ddff55128256e
SHA13d6b7b2419c726daf5a482ed038a4580660764e7
SHA2567d96cc64144e26403700c4cb6cb7b2ae799480c76a47c8481ca0f0c585276e1a
SHA51272e034d60cdae11114ab85c6643ae9df5ae0f69fb3499e8f8414081a470b0f32012d085ede5eb8245058d97b6fbb3e1816c49dfd830ea82533f5a26b3ff79f17
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
680KB
MD5f8e6ae887c9c387c00d53210a68c1356
SHA166a2dc7c8931bd384e3d5672840f2bed34447a58
SHA2562bc9ef602a307b60ab41b23e417fb74d7c2da963c7e0147bb5cbc2c773ef04ee
SHA5129c312753b9da120159a1751fcb755be0d8877190bb8e281de92c97a136f28b0cbcd34280b3833cd5d997d8cfef42386ce5e4d2e0aec4a82fac180dbb965c4929
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
744KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
648KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
648KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
648KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB