Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
Resource
win10v2004-20240226-en
General
-
Target
7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
-
Size
1.8MB
-
MD5
944763da3ca60554cc6befb9adbc4a8b
-
SHA1
666a0b24de76ef9907a0488bcfce63ba1426b6a7
-
SHA256
7ed000de7aa37968d95b86f688ab0b97219bd9ea686cb1cdedc861a687499180
-
SHA512
a8ff0fb59214e39b69adfa206d6e21ed8584542fa45dd53af56ff6bb712c81d05bc72792b195f9c1602049d7202ae5d1f874a2d2913cbbbfe17a5212de22f1a8
-
SSDEEP
49152:62r5Gxe+1W3rcbHvLM8oW1wCKOKKuhi4Ml2aP:bQx43raHjM8oWjUSl2aP
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral2/memory/4916-69-0x00000000009D0000-0x0000000000A72000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 1716 fsound32.exe 4916 fsound32.exe -
Loads dropped DLL 1 IoCs
pid Process 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1748 1448 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 91 PID 1448 wrote to memory of 1748 1448 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 91 PID 1448 wrote to memory of 1748 1448 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe 91 PID 1748 wrote to memory of 1716 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 92 PID 1748 wrote to memory of 1716 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 92 PID 1748 wrote to memory of 1716 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 92 PID 1748 wrote to memory of 4916 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 93 PID 1748 wrote to memory of 4916 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 93 PID 1748 wrote to memory of 4916 1748 7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\is-33L9R.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp"C:\Users\Admin\AppData\Local\Temp\is-33L9R.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp" /SL5="$F0046,1494255,54272,C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i3⤵
- Executes dropped EXE
PID:1716
-
-
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s3⤵
- Executes dropped EXE
PID:4916
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD569331023065320773cf59319f481d329
SHA180ea2e902b4d90a042117cedc94e1a0ffd0ea4dd
SHA256c934b3b6cc750620a11b3e35d99a42a7d084b677be3ccb1a70e4f93ca8d93e6b
SHA5120884422e206b9528f4d1089993507c44a8bf2baa8e0b34fb679624ca57beb26724971e2e44d57183f185e05caec3ffac70c79fe1f0d6a536238bbb2877b9b43f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
677KB
MD54509b43c1a3454d372ea30a76a0be530
SHA19162334c63fee857285b9deab7974ab9e3e1bcd2
SHA25675de139a74c2db4fb283b893c64b41a5a445b16b9db601a582eb1f3f31586de4
SHA5127549e850495154b1ac9fb85dfe3929c27b5708606659d8df3ec6ec8de0808811641610de151c9570ffea7015dacd889042790110c4f8849660f98cd4a52275a0