Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win10v2004-20240802-en
General
-
Target
7b44bcbc214c78715d0f590b1635dfa9.exe
-
Size
539KB
-
MD5
7b44bcbc214c78715d0f590b1635dfa9
-
SHA1
ede3e1794545f9039260be883334a70e245abd38
-
SHA256
0a01299cae838e8920ce78f846e94890d3a08619316aacfe34f9deb0b364d69c
-
SHA512
7b8ffec18a6ba1034d9438ee1947c08321486da7e89a949bdca19ce43a6756af675db673981bed4fe9808a0f12ef52c6d26956164f4bcb1bdeba7b6b97661cea
-
SSDEEP
12288:oHANG3RciXGMbmAumsfKRsOB0IcvnO1gq6NgXH:oHxc2mVfV5IcvnO1R+g3
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/2176-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
pid Process 468 7b44bcbc214c78715d0f590b1635dfa9.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 468 set thread context of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b44bcbc214c78715d0f590b1635dfa9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2176 7b44bcbc214c78715d0f590b1635dfa9.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30 PID 468 wrote to memory of 2176 468 7b44bcbc214c78715d0f590b1635dfa9.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b44bcbc214c78715d0f590b1635dfa9.exe"C:\Users\Admin\AppData\Local\Temp\7b44bcbc214c78715d0f590b1635dfa9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\7b44bcbc214c78715d0f590b1635dfa9.exe"C:\Users\Admin\AppData\Local\Temp\7b44bcbc214c78715d0f590b1635dfa9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
194KB
MD5c1ee8fc3cb583c07338524ac89801344
SHA1041872fd3d00b10c7983f641be1e579bb709e6b7
SHA2562b1efdc452245df048688e006a8d7c103e5ec369cab07125060161752ea6d8b6
SHA512bd59b363d5c6e01a5f92e17f3c8c86eda4793a7ca53fa062aa80632fdb2130df527991ceb3ac6f73edd09e22a8e71968d0b7ad6e50fb7a7f2f9ed417f82f0190