Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 07:56

General

  • Target

    7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe

  • Size

    1.8MB

  • MD5

    944763da3ca60554cc6befb9adbc4a8b

  • SHA1

    666a0b24de76ef9907a0488bcfce63ba1426b6a7

  • SHA256

    7ed000de7aa37968d95b86f688ab0b97219bd9ea686cb1cdedc861a687499180

  • SHA512

    a8ff0fb59214e39b69adfa206d6e21ed8584542fa45dd53af56ff6bb712c81d05bc72792b195f9c1602049d7202ae5d1f874a2d2913cbbbfe17a5212de22f1a8

  • SSDEEP

    49152:62r5Gxe+1W3rcbHvLM8oW1wCKOKKuhi4Ml2aP:bQx43raHjM8oWjUSl2aP

Malware Config

Extracted

Family

socks5systemz

C2

http://beivsqv.com/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f671ea771795af8e05c642db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a628afe15c2ec96

http://beivsqv.com/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12eab517aa5c96bd86eb978f45805a8bbc896c58e713bc90c91d36b5281fc235a925ed3e55d6bd974a95129070b611e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c5eb949e39ce6c

Signatures

  • Detect Socks5Systemz Payload 3 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
    "C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\is-3UAHE.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3UAHE.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp" /SL5="$4010A,1494255,54272,C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2660
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s
        3⤵
        • Executes dropped EXE
        PID:2804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Focus Sound\fsound32.exe

    Filesize

    1.9MB

    MD5

    69331023065320773cf59319f481d329

    SHA1

    80ea2e902b4d90a042117cedc94e1a0ffd0ea4dd

    SHA256

    c934b3b6cc750620a11b3e35d99a42a7d084b677be3ccb1a70e4f93ca8d93e6b

    SHA512

    0884422e206b9528f4d1089993507c44a8bf2baa8e0b34fb679624ca57beb26724971e2e44d57183f185e05caec3ffac70c79fe1f0d6a536238bbb2877b9b43f

  • \Users\Admin\AppData\Local\Temp\is-3UAHE.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp

    Filesize

    677KB

    MD5

    4509b43c1a3454d372ea30a76a0be530

    SHA1

    9162334c63fee857285b9deab7974ab9e3e1bcd2

    SHA256

    75de139a74c2db4fb283b893c64b41a5a445b16b9db601a582eb1f3f31586de4

    SHA512

    7549e850495154b1ac9fb85dfe3929c27b5708606659d8df3ec6ec8de0808811641610de151c9570ffea7015dacd889042790110c4f8849660f98cd4a52275a0

  • \Users\Admin\AppData\Local\Temp\is-CGDJK.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-CGDJK.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/1320-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/1320-53-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1320-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2660-49-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2660-44-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2660-45-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-55-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-68-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-102-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-99-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-95-0x0000000002650000-0x00000000026F2000-memory.dmp

    Filesize

    648KB

  • memory/2804-58-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-94-0x0000000002650000-0x00000000026F2000-memory.dmp

    Filesize

    648KB

  • memory/2804-62-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-65-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-51-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-71-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-72-0x0000000002650000-0x00000000026F2000-memory.dmp

    Filesize

    648KB

  • memory/2804-78-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-81-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-84-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-87-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-90-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/2804-93-0x0000000000400000-0x00000000005E1000-memory.dmp

    Filesize

    1.9MB

  • memory/3020-43-0x00000000034F0000-0x00000000036D1000-memory.dmp

    Filesize

    1.9MB

  • memory/3020-59-0x00000000034F0000-0x00000000036D1000-memory.dmp

    Filesize

    1.9MB

  • memory/3020-54-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/3020-12-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB