Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/06/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe
Resource
win11-20240508-en
General
-
Target
6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe
-
Size
6.2MB
-
MD5
00f68ec59482a94888719985b269ce9b
-
SHA1
7167ee643e2bc4703f05ff9458da97f437362aee
-
SHA256
6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7
-
SHA512
0335e4b3973d660a00f31677dd4bc4212613ab61b85927a480a077e322b5acbb5aab57373637296f910c587a6ca2d2a64df62e2ea175242d6078ccd8ed94ad6b
-
SSDEEP
98304:mXoF/KsTkPom8xmvPYVCTi6zIILUGPNrP0k0kfY89Xl5yaiUfz5I2rSTYujS5suY:tQsAPo1mvw0jIkZp0Hkw8UaPNIHjG2uY
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral2/memory/5068-86-0x0000000000CF0000-0x0000000000D92000-memory.dmp family_socks5systemz behavioral2/memory/5068-109-0x0000000000CF0000-0x0000000000D92000-memory.dmp family_socks5systemz behavioral2/memory/5068-110-0x0000000000CF0000-0x0000000000D92000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 3832 galaxymusicstudio32.exe 5068 galaxymusicstudio32.exe -
Loads dropped DLL 1 IoCs
pid Process 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2788 1824 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe 80 PID 1824 wrote to memory of 2788 1824 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe 80 PID 1824 wrote to memory of 2788 1824 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe 80 PID 2788 wrote to memory of 3832 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 82 PID 2788 wrote to memory of 3832 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 82 PID 2788 wrote to memory of 3832 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 82 PID 2788 wrote to memory of 5068 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 83 PID 2788 wrote to memory of 5068 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 83 PID 2788 wrote to memory of 5068 2788 6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe"C:\Users\Admin\AppData\Local\Temp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\is-LGPVN.tmp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp"C:\Users\Admin\AppData\Local\Temp\is-LGPVN.tmp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp" /SL5="$40208,6206406,54272,C:\Users\Admin\AppData\Local\Temp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe"C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe" -i3⤵
- Executes dropped EXE
PID:3832
-
-
C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe"C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe" -s3⤵
- Executes dropped EXE
PID:5068
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5b9e81579f90b3a9dfeaf9b2ac634478f
SHA18b89259a2bfde30e8483917922e96e3be22cbc3d
SHA25697ae0e70a6d660359270d810d8a668e44ab175d89cb83022622f912b9e62b8e0
SHA51295bd9950167d8713f055461adb51c90f5b726214c36395e6c73b70047fba1d040e93b3a7813162692a7f2245eb5a5eb72dcfa54e72a07bb673c453d42024fc54
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-LGPVN.tmp\6440835a706611ccec86a174da1ad5a3a92398549efbb050f91c2f7ce73604e7.tmp
Filesize680KB
MD578f695ace22daf36e34fa37782f0dd80
SHA14098c49735260753da510587fd946153ce2c2001
SHA2560395db2b5a63eaed214bd1d2831931bfc5621f136567254c82fcc02821e26f30
SHA5126def356098859e3fb2806126e6515a1e76a9efb8c95edbf53f8b6fef41302a77a9f791a4b3bec08fae82693c7f77192161aacd7a66c22043a520cb8aa14c3861