Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
ORDER#710665_PDF.exe
Resource
win7-20240220-en
General
-
Target
ORDER#710665_PDF.exe
-
Size
227KB
-
MD5
e3f8392aa03280bb36a3dc058e44fca5
-
SHA1
2f7efa75f8c1d791007a006bd820a2f735b7fb22
-
SHA256
cc0e5224224cd1137d4cdff798462d06a7e5e39e97858aac2ecc3c27b5c30b42
-
SHA512
5323da860079bf60e6f96dc6a99f2d50e086279b9563d1c5173ed3d17a02fbffa304be01c5f31e20c35e1d18c2891d00dda888cdaf54aae9e5c29b5381856faa
-
SSDEEP
6144:PUd4OmBdYEOOTIPm1+F0lwq/xBQe+UKy9q:CNsvOxPmsWlwq5togq
Malware Config
Extracted
xloader
2.3
usvr
theblockmeatstore.com
drone-moment.com
srsfashionbd.com
kylayagerartwork.com
instagrams.tools
rosenwealth.com
indicraftsvilla.com
rswizard.com
irist.one
pubgclaimx14.com
thegeorgiahomefinder.com
unusualdog.com
kifayatikart.com
methodunit.net
bavarian-luxury.com
17391000.com
ipcsaveday.com
yael-b.com
pasionqueconecta.com
youngsvideography.com
absorbscratch.icu
nzrugbylife.info
inabellesolutions.com
applesoso.com
soshop365.com
viewmydiary.com
onemillionrosary.com
erotickykontakt.com
xn--yfr994dchc.net
quiltedpicturebooks.com
monteiromarquesadv.com
anugrahdayakencana.com
jz-fh.com
beijingjiadu.com
qdwentang.com
shandasden.com
xn--bckb2ercf4fxgsa3e.xyz
ecozoca.com
spiritsvest.com
pigsflycheap.com
onenationunderbread.com
bunganutlakecampingarea.com
deltafinancialgroup.net
glamsocialevents.com
sportzdestinations.com
memento-lagoon.com
nuvo-condos.com
urteiki.com
negociosconjuanceri.com
finescocms.com
simposiocpa.com
topelk.com
duetoboias.com
priormakers.net
impossibilitee.com
zombiguitar.com
conseilaffaires.com
ecrires.xyz
magetu.info
miracle-tone.com
quranvisor.com
thebabytemplate.com
wcarrillo.com
wallstmotorsports.com
microprojects.net
Signatures
-
Xloader payload 5 IoCs
resource yara_rule behavioral1/memory/2900-2-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2900-6-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2900-11-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2652-20-0x0000000000090000-0x00000000000B8000-memory.dmp xloader behavioral1/memory/2652-22-0x0000000000090000-0x00000000000B8000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
flow pid Process 10 2652 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2516 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2920 set thread context of 2900 2920 ORDER#710665_PDF.exe 29 PID 2900 set thread context of 1100 2900 ORDER#710665_PDF.exe 20 PID 2900 set thread context of 1100 2900 ORDER#710665_PDF.exe 20 PID 2652 set thread context of 1100 2652 rundll32.exe 20 -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2900 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2920 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2900 ORDER#710665_PDF.exe 2652 rundll32.exe 2652 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2900 ORDER#710665_PDF.exe Token: SeDebugPrivilege 2652 rundll32.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2900 2920 ORDER#710665_PDF.exe 29 PID 2920 wrote to memory of 2900 2920 ORDER#710665_PDF.exe 29 PID 2920 wrote to memory of 2900 2920 ORDER#710665_PDF.exe 29 PID 2920 wrote to memory of 2900 2920 ORDER#710665_PDF.exe 29 PID 2920 wrote to memory of 2900 2920 ORDER#710665_PDF.exe 29 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 1100 wrote to memory of 2652 1100 Explorer.EXE 30 PID 2652 wrote to memory of 2516 2652 rundll32.exe 31 PID 2652 wrote to memory of 2516 2652 rundll32.exe 31 PID 2652 wrote to memory of 2516 2652 rundll32.exe 31 PID 2652 wrote to memory of 2516 2652 rundll32.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER#710665_PDF.exe"3⤵
- Deletes itself
PID:2516
-
-