Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 07:56

General

  • Target

    7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe

  • Size

    1.8MB

  • MD5

    944763da3ca60554cc6befb9adbc4a8b

  • SHA1

    666a0b24de76ef9907a0488bcfce63ba1426b6a7

  • SHA256

    7ed000de7aa37968d95b86f688ab0b97219bd9ea686cb1cdedc861a687499180

  • SHA512

    a8ff0fb59214e39b69adfa206d6e21ed8584542fa45dd53af56ff6bb712c81d05bc72792b195f9c1602049d7202ae5d1f874a2d2913cbbbfe17a5212de22f1a8

  • SSDEEP

    49152:62r5Gxe+1W3rcbHvLM8oW1wCKOKKuhi4Ml2aP:bQx43raHjM8oWjUSl2aP

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe
    "C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\is-33L9R.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-33L9R.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp" /SL5="$F0046,1494255,54272,C:\Users\Admin\AppData\Local\Temp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i
        3⤵
        • Executes dropped EXE
        PID:1716
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s
        3⤵
        • Executes dropped EXE
        PID:4916
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe

      Filesize

      1.9MB

      MD5

      69331023065320773cf59319f481d329

      SHA1

      80ea2e902b4d90a042117cedc94e1a0ffd0ea4dd

      SHA256

      c934b3b6cc750620a11b3e35d99a42a7d084b677be3ccb1a70e4f93ca8d93e6b

      SHA512

      0884422e206b9528f4d1089993507c44a8bf2baa8e0b34fb679624ca57beb26724971e2e44d57183f185e05caec3ffac70c79fe1f0d6a536238bbb2877b9b43f

    • C:\Users\Admin\AppData\Local\Temp\is-0MI1M.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • C:\Users\Admin\AppData\Local\Temp\is-33L9R.tmp\7ED000DE7AA37968D95B86F688AB0B97219BD9EA686CB.tmp

      Filesize

      677KB

      MD5

      4509b43c1a3454d372ea30a76a0be530

      SHA1

      9162334c63fee857285b9deab7974ab9e3e1bcd2

      SHA256

      75de139a74c2db4fb283b893c64b41a5a445b16b9db601a582eb1f3f31586de4

      SHA512

      7549e850495154b1ac9fb85dfe3929c27b5708606659d8df3ec6ec8de0808811641610de151c9570ffea7015dacd889042790110c4f8849660f98cd4a52275a0

    • memory/1448-2-0x0000000000401000-0x000000000040B000-memory.dmp

      Filesize

      40KB

    • memory/1448-17-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/1448-0-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/1716-39-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/1716-40-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/1716-41-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/1716-45-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/1748-50-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/1748-7-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/4916-52-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-68-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-47-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-55-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-56-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-59-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-62-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-65-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-69-0x00000000009D0000-0x0000000000A72000-memory.dmp

      Filesize

      648KB

    • memory/4916-49-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-75-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-78-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-81-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-82-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-85-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-88-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB

    • memory/4916-91-0x0000000000400000-0x00000000005E1000-memory.dmp

      Filesize

      1.9MB