Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
submitted
15/09/2024, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Resource
win10v2004-20240802-en
General
-
Target
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
-
Size
2.0MB
-
MD5
35121587dbb5bb683d90486001a25dbb
-
SHA1
0f99e228a35b03dd7ebc21aaf22f81ba7de4c484
-
SHA256
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28
-
SHA512
e56f60d73148ebf0ea67366bd8b02165630b578d8fec75d2d9ad36a9a842bfc69fdfda153f7995b60750cf1924a6ecf5ae4b004f21ef385c8e7deb58b37c02a6
-
SSDEEP
49152:unsHyjtk2MYC5GD566aa+++b+xBxAtO7/eZffw8VpeDn7kJQ8Za8Se1:unsmtk2a67/eZnw8VpeD7QQ8jSy
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2428 ._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 2772 Synaptics.exe 2984 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 2772 Synaptics.exe 2772 Synaptics.exe 2772 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2656 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 804 wrote to memory of 2428 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 30 PID 804 wrote to memory of 2428 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 30 PID 804 wrote to memory of 2428 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 30 PID 804 wrote to memory of 2428 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 30 PID 804 wrote to memory of 2772 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 31 PID 804 wrote to memory of 2772 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 31 PID 804 wrote to memory of 2772 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 31 PID 804 wrote to memory of 2772 804 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 31 PID 2772 wrote to memory of 2984 2772 Synaptics.exe 32 PID 2772 wrote to memory of 2984 2772 Synaptics.exe 32 PID 2772 wrote to memory of 2984 2772 Synaptics.exe 32 PID 2772 wrote to memory of 2984 2772 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"C:\Users\Admin\AppData\Local\Temp\c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"C:\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"2⤵
- Executes dropped EXE
PID:2428
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2984
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD535121587dbb5bb683d90486001a25dbb
SHA10f99e228a35b03dd7ebc21aaf22f81ba7de4c484
SHA256c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28
SHA512e56f60d73148ebf0ea67366bd8b02165630b578d8fec75d2d9ad36a9a842bfc69fdfda153f7995b60750cf1924a6ecf5ae4b004f21ef385c8e7deb58b37c02a6
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD564d156769ddf6c350cbfbb6a1ba393c3
SHA19b6aea38ca7ab20c84794b5e66dba1f11b934589
SHA256495741aee1d703151fd50d952fcff2fdfcc2fabb9943f89026c0b5ca3ed0082b
SHA512f9e0dfc3eb15c330ea5d4a01072fc4328e8a326338fec4ebb3da084438f7ae0035bf07a8a7b92239b19535151afae7145ba5d734eb4cb15aaf06beeeb3f179ca
-
\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Filesize1.3MB
MD5b13bc5b62f54607c334a6464d9b85cc8
SHA112721c69acbcb515f7adbee08ec42fc61192c187
SHA25651791625054b01802fd5aaa6c4a929827b369dfef7b2891b5f55e0fa61af0c7d
SHA51258a9c4e413992b8c225fd622934929382070cbe8c8999bdb93851a1f46a0129d674135eacce2b3f96a19dfbb7333e3b921b5e39b727339c9897de7a02d2ce3bf