Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 18:22 UTC

General

  • Target

    fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.exe

  • Size

    4.2MB

  • MD5

    14d0694a693ba65335b2404f3cc54310

  • SHA1

    3be0c605103dce36867643b09861cf17accc3451

  • SHA256

    fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630f

  • SHA512

    ccba663090d55785c1391db66b43b33bc7e4b36670f440cd69a296e31fbb6bc75f6078f48b5599d3c5ecb663cc443ae720c1bdffc8e2a80a18a601db280cf0f6

  • SSDEEP

    98304:mQNUPs6cv999CIgObKeB8iyKn5Nhq5OjbmAYHz2R7z7q:vP6u99JgOpVy25NUOihT2RP+

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Socks5systemz family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.exe
    "C:\Users\Admin\AppData\Local\Temp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Temp\is-2MGM1.tmp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2MGM1.tmp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.tmp" /SL5="$50154,4154501,54272,C:\Users\Admin\AppData\Local\Temp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc32.exe
        "C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc32.exe" -i
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2504

Network

  • flag-ru
    DNS
    cextviu.net
    softartsvc32.exe
    Remote address:
    152.89.198.214:53
    Request
    cextviu.net
    IN A
    Response
    cextviu.net
    IN A
    185.208.158.202
  • flag-us
    GET
    http://cextviu.net/search/?q=67e28dd83954fb2a415dad497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a371ea771795af8e05c444db22f31df92d8b38e316a667d307eca743ec4c2b07b5296692386788fa19c2ec91
    softartsvc32.exe
    Remote address:
    185.208.158.202:80
    Request
    GET /search/?q=67e28dd83954fb2a415dad497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a371ea771795af8e05c444db22f31df92d8b38e316a667d307eca743ec4c2b07b5296692386788fa19c2ec91 HTTP/1.1
    Host: cextviu.net
    User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.20.1
    Date: Sun, 03 Nov 2024 18:24:57 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-Powered-By: PHP/7.4.33
  • 185.208.158.202:80
    http://cextviu.net/search/?q=67e28dd83954fb2a415dad497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a371ea771795af8e05c444db22f31df92d8b38e316a667d307eca743ec4c2b07b5296692386788fa19c2ec91
    http
    softartsvc32.exe
    550 B
    612 B
    5
    4

    HTTP Request

    GET http://cextviu.net/search/?q=67e28dd83954fb2a415dad497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a371ea771795af8e05c444db22f31df92d8b38e316a667d307eca743ec4c2b07b5296692386788fa19c2ec91

    HTTP Response

    200
  • 152.89.198.214:53
    cextviu.net
    dns
    softartsvc32.exe
    57 B
    84 B
    1
    1

    DNS Request

    cextviu.net

    DNS Response

    185.208.158.202

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\SoftArts Video Converter\softartsvc32.exe

    Filesize

    3.0MB

    MD5

    851311c78baf76bd30ea157c774cf9a3

    SHA1

    6e70ab9b7c0300d09acba5b05904b56bb9478d0f

    SHA256

    de70f9f1da0fe55a91c564fdb95bbf052afe263a82686fe0e267c9f967d937a8

    SHA512

    a15a4fd2b2300e116e5276d831edc8a2640d373bff7433ce6d71bedac5a66ddf3e22211f0b94c8ee6cd8f1abe05c071a239d45177d61d9c33256ff4d1d2a1fac

  • \Users\Admin\AppData\Local\Temp\is-2MGM1.tmp\fac7197c6c5e3e19cc9ca49813dc1be918fe442fa2ab529f231b7a8816c5630fN.tmp

    Filesize

    677KB

    MD5

    fd9a043395f5e065baeb5a5343812fdd

    SHA1

    17830b401d73b434d0228f30176f2e8ea56ee5ec

    SHA256

    b47b1bf8b35055ee54b2a21e24725d8590a9a3eca32e6a1e3aaca99ca54a2fb9

    SHA512

    3a52f79e3defbaa764289cfb1cd4421e3edd8c205d99f8330401ca4c27ae13bedfa27f74046d9c3527d4403218ae0f7236c9ffe566762f5a9983829fc855bdb1

  • \Users\Admin\AppData\Local\Temp\is-BCS08.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-BCS08.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/2108-82-0x0000000005AA0000-0x0000000005DB7000-memory.dmp

    Filesize

    3.1MB

  • memory/2108-115-0x0000000005AA0000-0x0000000005DB7000-memory.dmp

    Filesize

    3.1MB

  • memory/2108-9-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2108-87-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/2504-96-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-105-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-83-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-135-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-90-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-93-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-132-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-99-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-102-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-84-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-106-0x0000000002920000-0x00000000029C2000-memory.dmp

    Filesize

    648KB

  • memory/2504-112-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-128-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-116-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-119-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-122-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2504-125-0x0000000000400000-0x0000000000717000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2808-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2808-88-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.