Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
Resource
win10v2004-20240226-en
General
-
Target
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
-
Size
1.8MB
-
MD5
944763da3ca60554cc6befb9adbc4a8b
-
SHA1
666a0b24de76ef9907a0488bcfce63ba1426b6a7
-
SHA256
7ed000de7aa37968d95b86f688ab0b97219bd9ea686cb1cdedc861a687499180
-
SHA512
a8ff0fb59214e39b69adfa206d6e21ed8584542fa45dd53af56ff6bb712c81d05bc72792b195f9c1602049d7202ae5d1f874a2d2913cbbbfe17a5212de22f1a8
-
SSDEEP
49152:62r5Gxe+1W3rcbHvLM8oW1wCKOKKuhi4Ml2aP:bQx43raHjM8oWjUSl2aP
Malware Config
Extracted
socks5systemz
http://beivsqv.com/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f671ea771795af8e05c642db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628afe15c2ec96
http://beivsqv.com/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12eab517aa5c96bd86eb978f45805a8bbc896c58e713bc90c91d36b5281fc235a925ed3e55d6bd974a95129070b611e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5eb949e39ce6c
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral1/memory/2804-72-0x0000000002650000-0x00000000026F2000-memory.dmp family_socks5systemz behavioral1/memory/2804-95-0x0000000002650000-0x00000000026F2000-memory.dmp family_socks5systemz behavioral1/memory/2804-94-0x0000000002650000-0x00000000026F2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 2660 fsound32.exe 2804 fsound32.exe -
Loads dropped DLL 5 IoCs
pid Process 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 1320 wrote to memory of 3020 1320 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 28 PID 3020 wrote to memory of 2660 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 29 PID 3020 wrote to memory of 2660 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 29 PID 3020 wrote to memory of 2660 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 29 PID 3020 wrote to memory of 2660 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 29 PID 3020 wrote to memory of 2804 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 30 PID 3020 wrote to memory of 2804 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 30 PID 3020 wrote to memory of 2804 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 30 PID 3020 wrote to memory of 2804 3020 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\is-3UAHE.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp"C:\Users\Admin\AppData\Local\Temp\is-3UAHE.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp" /SL5="$4010A,1494255,54272,C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i3⤵
- Executes dropped EXE
PID:2660
-
-
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s3⤵
- Executes dropped EXE
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD569331023065320773cf59319f481d329
SHA180ea2e902b4d90a042117cedc94e1a0ffd0ea4dd
SHA256c934b3b6cc750620a11b3e35d99a42a7d084b677be3ccb1a70e4f93ca8d93e6b
SHA5120884422e206b9528f4d1089993507c44a8bf2baa8e0b34fb679624ca57beb26724971e2e44d57183f185e05caec3ffac70c79fe1f0d6a536238bbb2877b9b43f
-
Filesize
677KB
MD54509b43c1a3454d372ea30a76a0be530
SHA19162334c63fee857285b9deab7974ab9e3e1bcd2
SHA25675de139a74c2db4fb283b893c64b41a5a445b16b9db601a582eb1f3f31586de4
SHA5127549e850495154b1ac9fb85dfe3929c27b5708606659d8df3ec6ec8de0808811641610de151c9570ffea7015dacd889042790110c4f8849660f98cd4a52275a0
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3