Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
323s -
max time network
277s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/05/2024, 18:05
Behavioral task
behavioral1
Sample
Xfer.Records.Serum.v1.36b8-R2R.zip
Resource
win11-20240508-en
General
-
Target
Xfer.Records.Serum.v1.36b8-R2R.zip
-
Size
176.2MB
-
MD5
fee15e40d50da2140ae84629b288ab72
-
SHA1
ea5cb5e2042fb51a805bc9b1fb58f8b4a89ad7b0
-
SHA256
c655d27470498750efd7cd32a14b8bbdb421ce9f7012935d1e1014a7f8241ba5
-
SHA512
440c8cc447644db276a67da2883447c41f51fd19e987e19ad574b4dc472bd110e2fb529326af0ae9d3d6326b5dd5502dc39761a8134d03024e050104a3b61188
-
SSDEEP
3145728:PpyR6xHq8EOUon92WYiojoIiW5cfq4nJ7GHP/BQbFCYT20coSMMjHEkGco:PkRcHq8GG2CPIilfJnJ7GvgDIHE6o
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4704 keygen.exe -
Loads dropped DLL 6 IoCs
pid Process 3268 Install_Xfer_Serum_136b8.exe 3268 Install_Xfer_Serum_136b8.exe 3268 Install_Xfer_Serum_136b8.exe 4704 keygen.exe 4704 keygen.exe 4704 keygen.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\Serum.vst3\desktop.ini Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\desktop.ini Install_Xfer_Serum_136b8.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\Serum.vst3\desktop.ini Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot.png Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot.png Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\x86_64-win Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\x86_64-win\Serum.vst3 Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST2\Serum.dll Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\PlugIn.ico Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\desktop.ini Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\moduleinfo.json Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources\Snapshots Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST3\Serum.vst3\Contents\moduleinfo.json Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot_2.0x.png Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST3\Serum.vst3\PlugIn.ico Install_Xfer_Serum_136b8.exe File opened for modification C:\Program Files\Common Files\VST3\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot_2.0x.png Install_Xfer_Serum_136b8.exe File created C:\Program Files\Common Files\VST3\Serum.vst3\Contents\x86_64-win\Serum.vst3 Install_Xfer_Serum_136b8.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Install_Xfer_Serum_136b8.exe Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Install_Xfer_Serum_136b8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 Install_Xfer_Serum_136b8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4472 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4472 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1520 Xfer_KeyGen.exe 4704 keygen.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 4704 1520 Xfer_KeyGen.exe 90 PID 1520 wrote to memory of 4704 1520 Xfer_KeyGen.exe 90 PID 1520 wrote to memory of 4704 1520 Xfer_KeyGen.exe 90
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Xfer.Records.Serum.v1.36b8-R2R.zip1⤵PID:2836
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2748
-
C:\Users\Admin\Documents\Xfer.Records.Serum.v1.36b8-R2R\Xfer.Records.Serum.v1.36b8-R2R\Install_Xfer_Serum_136b8.exe"C:\Users\Admin\Documents\Xfer.Records.Serum.v1.36b8-R2R\Xfer.Records.Serum.v1.36b8-R2R\Install_Xfer_Serum_136b8.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3268
-
C:\Users\Admin\Documents\Xfer.Records.Serum.v1.36b8-R2R\Xfer.Records.Serum.v1.36b8-R2R\R2R\Xfer_KeyGen.exe"C:\Users\Admin\Documents\Xfer.Records.Serum.v1.36b8-R2R\Xfer.Records.Serum.v1.36b8-R2R\R2R\Xfer_KeyGen.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\keygen.exeC:\Users\Admin\AppData\Local\Temp\keygen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4704
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004B41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
Filesize
3KB
MD5fb235a312dbde4daf45aa6d62923d2c4
SHA167580595f059640b974cd585b3deac25aba5928e
SHA256fb2ef28d03f1bbc60cb564cc8d90b3469f3ad393d81020b4afe2501c1b60da9c
SHA51214c7ba743221520753266119b4f91023321fdead7e3f941e4c6ede1b439886fcdfe7565eefd00d03f7c93686234ccd7369e150f2ad344d365ed0447c6aa6f898
-
Filesize
459KB
MD527bb415f94ed6f7bbbe60147e256d806
SHA1311558f88abe5095c46641368982f1effc8dabc5
SHA25609eb0d54924d998add82d73ba86350ac09c1f5714d895e08c77f34441da1c2c3
SHA512161dbae65d5ef4f2bbb4c57fa18c72b3c2b2a5993bc763d673832899eaa3d120697d4192362d2270e0d9630b0dc9429b3e221bb44cf0ff59de46e949d2a4cc70
-
Filesize
249KB
MD539940bef79a1d23adf86979d4d4cceed
SHA1593f9ea0cd0c1c4ec35c92a4473ed05437fb22ce
SHA256941267a1bd1328f21bbaf3a1ba5abe12196c3d57e4c49134c6764e7b143767d8
SHA51212b8f61bb8c1c661d7d4c7aff5e2e3f2915cd1b3c923bf9b17dd3bcc8b3ffb4145aa86b284bedd2695c6e62117cc1257a896dfe3227961deac35e8e9836d12c3
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
-
Filesize
6KB
MD51871af84805057b5ebc05ee46b56625d
SHA150e1c315ad30f5f3f300c7cd9dd0d5d626fe0167
SHA25662b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621
SHA512c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4
-
Filesize
150KB
MD5fd944873f187518849e6e3336c45f968
SHA13ba4d7d455372a329eb44200ecdd2e3075869047
SHA25654eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d
SHA512d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e
-
Filesize
9KB
MD548f3e7860e1de2b4e63ec744a5e9582a
SHA1420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA2566bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
SHA51228716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
-
Filesize
1KB
MD55bb22ab624d9c111ccff980846e21c99
SHA1a200fec196a8f0a4b798d3fa73f2e715ed547835
SHA256a0a1c6ea69b0a6a1aa6d6bd6bd295e8df710ab4f819c1aeecf2c5786f26d1059
SHA5120b9c2a9a0b18bebe29790355affeab7cdfcf4955e7464c9660c08d737850ad3ec7c8457be8980e567a8d922fe28beec8f29ed4ae30ca4a1e05896669ea26736d
-
Filesize
1KB
MD5c2636cab1581b01001bd665189fda63c
SHA176b394eea28541efc8574bd7773a35e1fca67ce5
SHA2567f489f7a78e8153edd85b24f6f724a21895d10d5c8f40197c7af7e68960bda66
SHA5125387376cc01d2d638c628d20c0471d582896641b9a5236bd78f76331a92b173d59a3d09cdda38fa2c648a07c3716972e657f5ab4868557d5bc928bcb36d721d7
-
Filesize
1KB
MD53d370826d1b4c223b7975cbc2a064eb1
SHA18eabeabf9798ee63cf7cbe3df3f2c22c5aa4798c
SHA256d34652d56f2a61d28d1c350fc180a1ce1642c29bcb5fe05a77b9b256711468f4
SHA512b502d2dd5e572705a7d7a75060ecd5c20e8f0f7307dfad659ebd3c62079d48bba0b3ba80117b62412ad2bc0eb114e8037c9e8ae9201b30acd72e9217861e4d6a
-
Filesize
2KB
MD55d857b9000d78b502e2ffb8d0e6647de
SHA10e27ede07ddb9dcc6ddf1f9831c4c70988ca066c
SHA256f8e352e45b99c51541c641e79336b0ac71bed60de31f866caed96e42b42adae4
SHA512d3ebb20a9cff226947e477aa990982e0a8a4b27202e7b915d66622531e9e7832a3a1e9ecb86c5d27688498a88d3fbcec3b4272a340be8a4a03e52db99d5161f7
-
Filesize
2KB
MD52b4d9090fdb2bdedb973155412b06ab8
SHA111d7b407d00d081414fbed0f35b8cfb491e0e90f
SHA256981ca03de861ee80f0049bd33abbbcc2322aaa23499f31c6bf274750cc14dfd8
SHA5126d0428b866103203b38fb06b22364c8e3591adf23fcc0b32d7f5de048348a4af1e2d7913f39de84e7e47eca3c41995365959c2a1c77243a3d5f42809c5d14072