Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 23:50 UTC

General

  • Target

    1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.exe

  • Size

    4.2MB

  • MD5

    520032826525047277dbe788c71522a0

  • SHA1

    464f3a511b62da428fa823f0ea5b162fda063f08

  • SHA256

    1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2ca

  • SHA512

    0255324d69eab8b2b2ae1d44dca60a12bac386cc4c3a931f77a0e187c31772abce983054dbafd57927d7b8d39ba333efe54ffb513b59a66b8ef6efbcdba81af2

  • SSDEEP

    98304:IkOxuz5BpTrVqEpwuA2ONMy1TAWmTnv19ZKH5xQ:xOkzBTr1wuA2OF1TAWWv19kHbQ

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Socks5systemz family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.exe
    "C:\Users\Admin\AppData\Local\Temp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\is-7IT4K.tmp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7IT4K.tmp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.tmp" /SL5="$40152,4075624,54272,C:\Users\Admin\AppData\Local\Temp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe
        "C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe" -i
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe

    Filesize

    2.9MB

    MD5

    238fc4c63ada0c3ab8e0037ec9209792

    SHA1

    9bffc7f3fc7da93bc5b7e26d5a2216ebbc17ce1a

    SHA256

    6d12fc8deac20d6b6a08cf2d520f4b0f81313690a4484cc7c47f346f7d5e2f62

    SHA512

    66c3d58044e48dca5781d80e756fb26e992a243e8106c99464dd673578a6663c359f9bcfda66924ad73994986a8ed59fbc243aea5033e417c0aeca7cc8515a21

  • \Users\Admin\AppData\Local\Temp\is-7IT4K.tmp\1db923d92258d09980de5d454b997bf8f1eb86cc66ff86f1228dfc6001a6e2caN.tmp

    Filesize

    689KB

    MD5

    9779b65b55f2dc6173e7b853fb6800f6

    SHA1

    54c55beba837b7c7cd8353246b25da7620c73609

    SHA256

    ab7eb19eb483355bb9180b738d8d2d95763bc17f0e6bd68f4dca14414e7782d5

    SHA512

    017fc5de8d64633bb02352ed0de073ef05b5033a675fb477ec49b3187808f1fbd95e8735b5fc718115bf37ba716796c5978a3681d9b3b88402627ba1ebeef388

  • \Users\Admin\AppData\Local\Temp\is-MVB8I.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-MVB8I.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/2116-87-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2116-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2116-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2364-8-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2364-115-0x0000000005100000-0x00000000053F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2364-80-0x0000000005100000-0x00000000053F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2364-86-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2800-89-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-105-0x0000000002A00000-0x0000000002AA2000-memory.dmp

    Filesize

    648KB

  • memory/2800-92-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-95-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-98-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-101-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-104-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-83-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-111-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-114-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-82-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-118-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-121-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

  • memory/2800-124-0x0000000000400000-0x00000000006F3000-memory.dmp

    Filesize

    2.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.