Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2024, 02:48
Behavioral task
behavioral1
Sample
68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe
Resource
win10v2004-20241007-en
General
-
Target
68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe
-
Size
823KB
-
MD5
c2cdae15750e17383ec3b4225bf32a9f
-
SHA1
e743955ba3d7c6edaf4dae0400b990b271839eb7
-
SHA256
68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2
-
SHA512
8ef7aa545deb4e7a106b4e92744319522021aa8992a801e3330d5a0bbdefafb11571a3594dd38670916eda44387dfdbb208f9977a587e12ef3b5f38b4ebbdd51
-
SSDEEP
12288:ZMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9xEBpij:ZnsJ39LyjbJkQFMhmC+6GD92e
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe -
Executes dropped EXE 3 IoCs
pid Process 2104 ._cache_68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 568 Synaptics.exe 2776 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2152 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE 2152 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2104 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 85 PID 1852 wrote to memory of 2104 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 85 PID 1852 wrote to memory of 2104 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 85 PID 1852 wrote to memory of 568 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 86 PID 1852 wrote to memory of 568 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 86 PID 1852 wrote to memory of 568 1852 68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe 86 PID 568 wrote to memory of 2776 568 Synaptics.exe 88 PID 568 wrote to memory of 2776 568 Synaptics.exe 88 PID 568 wrote to memory of 2776 568 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe"C:\Users\Admin\AppData\Local\Temp\68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\._cache_68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823KB
MD5c2cdae15750e17383ec3b4225bf32a9f
SHA1e743955ba3d7c6edaf4dae0400b990b271839eb7
SHA25668d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2
SHA5128ef7aa545deb4e7a106b4e92744319522021aa8992a801e3330d5a0bbdefafb11571a3594dd38670916eda44387dfdbb208f9977a587e12ef3b5f38b4ebbdd51
-
C:\Users\Admin\AppData\Local\Temp\._cache_68d41d21c16bae85f9a857511a5a1b3ccc28adc3721b82b17262e0e64f5a53f2.exe
Filesize69KB
MD5f2b28d713c51ab91e3452f7f98416123
SHA1039b9b9562971d19e2ebdcd27d209ff26575b94c
SHA25629b58fcac5050f4c966a71c1ce147f33e221ff34ba3b1bfa6433e208ac708c14
SHA51248d389f477a77eb16389dc011e0e89ba93d28f3fb81fec3d00c3b606ab4d0cc27b45d945265e170172445da46028a7e69451dbf19b34a2e4c6d6b5987eb3eda8
-
Filesize
27KB
MD5f850a772f531484422246b6e6723fa34
SHA11e5fcc26079872a08b55462a4acc0e67c74a1120
SHA256f9d84cf777964bb52534c684b8343a8e272c3e8d41eade37cc13c27ce45e9a30
SHA5120a2599ee454416aa8810b906775839be2d9b4c35195d646014e629fcb5634dd30fedd2c61c890c7b386f4ac403249d9207f87886665c5075b2d0e85ca1e8aa72
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04