Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
submitted
15/09/2024, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Resource
win10v2004-20240802-en
General
-
Target
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
-
Size
2.0MB
-
MD5
35121587dbb5bb683d90486001a25dbb
-
SHA1
0f99e228a35b03dd7ebc21aaf22f81ba7de4c484
-
SHA256
c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28
-
SHA512
e56f60d73148ebf0ea67366bd8b02165630b578d8fec75d2d9ad36a9a842bfc69fdfda153f7995b60750cf1924a6ecf5ae4b004f21ef385c8e7deb58b37c02a6
-
SSDEEP
49152:unsHyjtk2MYC5GD566aa+++b+xBxAtO7/eZffw8VpeDn7kJQ8Za8Se1:unsmtk2a67/eZnw8VpeD7QQ8jSy
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 2976 ._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 3784 Synaptics.exe 4156 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3448 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE 3448 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4844 wrote to memory of 2976 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 93 PID 4844 wrote to memory of 2976 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 93 PID 4844 wrote to memory of 2976 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 93 PID 4844 wrote to memory of 3784 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 94 PID 4844 wrote to memory of 3784 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 94 PID 4844 wrote to memory of 3784 4844 c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe 94 PID 3784 wrote to memory of 4156 3784 Synaptics.exe 95 PID 3784 wrote to memory of 4156 3784 Synaptics.exe 95 PID 3784 wrote to memory of 4156 3784 Synaptics.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"C:\Users\Admin\AppData\Local\Temp\c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"C:\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe"2⤵
- Executes dropped EXE
PID:2976
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:4156
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:81⤵PID:1976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD535121587dbb5bb683d90486001a25dbb
SHA10f99e228a35b03dd7ebc21aaf22f81ba7de4c484
SHA256c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28
SHA512e56f60d73148ebf0ea67366bd8b02165630b578d8fec75d2d9ad36a9a842bfc69fdfda153f7995b60750cf1924a6ecf5ae4b004f21ef385c8e7deb58b37c02a6
-
C:\Users\Admin\AppData\Local\Temp\._cache_c47103fd537b36745b1b49e50d18c21ef35a955d5e585f7c66c2fd2455982f28.exe
Filesize1.3MB
MD5b13bc5b62f54607c334a6464d9b85cc8
SHA112721c69acbcb515f7adbee08ec42fc61192c187
SHA25651791625054b01802fd5aaa6c4a929827b369dfef7b2891b5f55e0fa61af0c7d
SHA51258a9c4e413992b8c225fd622934929382070cbe8c8999bdb93851a1f46a0129d674135eacce2b3f96a19dfbb7333e3b921b5e39b727339c9897de7a02d2ce3bf
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04