Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30343f7d982...0N.exe
windows7-x64
100343f7d982...0N.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3NBProjects...in.exe
windows7-x64
7NBProjects...in.exe
windows10-2004-x64
7Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
0343f7d9824f51e45c9cc6ffbe4a1c20N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0343f7d9824f51e45c9cc6ffbe4a1c20N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
NBProjects/ParticleFirmware/nbproject/private/uninstall-particle-toolchain.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
NBProjects/ParticleFirmware/nbproject/private/uninstall-particle-toolchain.exe
Resource
win10v2004-20240802-en
General
-
Target
0343f7d9824f51e45c9cc6ffbe4a1c20N.exe
-
Size
212KB
-
MD5
0343f7d9824f51e45c9cc6ffbe4a1c20
-
SHA1
81ea1a3648e3b9d4903398502cc5ac8fbd0a843a
-
SHA256
915e637e9e56872ab8f1318ea2aa2434c5161cd6bf289076ebecac66db6bd25b
-
SHA512
83c21afce52224b8b70be568e7bc6d90a4539984c627979bf7a1d172396e054496dd981ac95b0e8b0332467e9214188929974ec49fd5068f2f3b91e9f5e6b2e3
-
SSDEEP
3072:jLk395hYXJLM/6tdrHF3AHEAHVxd/Y/6fV4xRrB9sTQt4Ge9tBBTWw0vlT4H7n+B:jQqqWQkAHJX4XYkY9Pow0vlT4+B
Malware Config
Extracted
xloader
2.3
ntfs
muhammedunal.com
humanvitality.site
thebookofgremlins.com
jamsoles.online
lakelasvegas.homes
fairplay.site
stanversity.com
palacinkaneiva.com
chaseinbox.com
wakeycare.com
habitastulum.net
fundacjacd.com
2wxuit.com
igamingmediahq.com
umannedresearchlaboratories.com
bonedex.com
ebaiyoservices.co.uk
organichorsemanship.com
spanishbyhk.com
stepfields.com
thetravelingplant.com
culvercitylandscapedesign.com
ferguson-home.com
municipalidadcarolina.com
nanomicrocartridge.com
dogalsutcu.com
tautonon.xyz
liangtuqiche.com
bp10283.com
roomserviceturkey.com
landonlive.com
xn--sr3b11hq5b3i155aqwh1qa.com
cucdaigroup.com
euphoriamakeup.net
vr658.com
viniumoce.com
el-mercado.online
0327888.com
dieetadvies.club
kurutses6.com
goodresolve.com
retovida.com
vantage.city
windwardfinehomes.com
annalisedemuth.com
happynestboardinghomes.com
attorneyscottrynecki.com
carpetfittersswindon.com
aifgh-nyld.xyz
emporosofeden.com
findusedbikeparts.com
baincot.com
weatville.com
piilonkiertajat.com
rasgraf.net
ubikate.online
theoldschool.house
cybers.works
magellanhealthprovider.com
apinchoflatina.com
makethegreatestgreater.com
alexandregrothendieck.net
radiojawaku.com
unaloth.com
symbiilogan.com
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/1292-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 2 IoCs
pid Process 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1316 set thread context of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1292 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30 PID 1316 wrote to memory of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30 PID 1316 wrote to memory of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30 PID 1316 wrote to memory of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30 PID 1316 wrote to memory of 1292 1316 0343f7d9824f51e45c9cc6ffbe4a1c20N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0343f7d9824f51e45c9cc6ffbe4a1c20N.exe"C:\Users\Admin\AppData\Local\Temp\0343f7d9824f51e45c9cc6ffbe4a1c20N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\0343f7d9824f51e45c9cc6ffbe4a1c20N.exe"C:\Users\Admin\AppData\Local\Temp\0343f7d9824f51e45c9cc6ffbe4a1c20N.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f