Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2024, 22:24
Behavioral task
behavioral1
Sample
450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe
Resource
win10v2004-20241007-en
General
-
Target
450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe
-
Size
850KB
-
MD5
be78967f31e6d64350527f74126bed00
-
SHA1
e2eeb5fad201f7e3f44e1810ad8d77aa01bcace7
-
SHA256
450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd
-
SHA512
635d0cb68749146c3756ac296459144371fcbe278a1c0bf71de7364d37a535fce5171ea65bf5c634f0e00a3f5ec47ae1795693b8aa8883bb9486d5a1513cbbeb
-
SSDEEP
12288:BMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9OigkI6:BnsJ39LyjbJkQFMhmC+6GD9jgkD
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 216 ._cache_450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 2864 Synaptics.exe 2852 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1736 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE 1736 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4636 wrote to memory of 216 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 87 PID 4636 wrote to memory of 216 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 87 PID 4636 wrote to memory of 216 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 87 PID 4636 wrote to memory of 2864 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 88 PID 4636 wrote to memory of 2864 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 88 PID 4636 wrote to memory of 2864 4636 450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe 88 PID 2864 wrote to memory of 2852 2864 Synaptics.exe 90 PID 2864 wrote to memory of 2852 2864 Synaptics.exe 90 PID 2864 wrote to memory of 2852 2864 Synaptics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe"C:\Users\Admin\AppData\Local\Temp\450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\._cache_450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe"C:\Users\Admin\AppData\Local\Temp\._cache_450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
850KB
MD5be78967f31e6d64350527f74126bed00
SHA1e2eeb5fad201f7e3f44e1810ad8d77aa01bcace7
SHA256450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd
SHA512635d0cb68749146c3756ac296459144371fcbe278a1c0bf71de7364d37a535fce5171ea65bf5c634f0e00a3f5ec47ae1795693b8aa8883bb9486d5a1513cbbeb
-
C:\Users\Admin\AppData\Local\Temp\._cache_450e95e5770eed0478ef236077e07e113116bcbce0f7107ff51a41e58c6859fd.exe
Filesize96KB
MD5d72f003eda84a4c18ebb3e1c063eae07
SHA1dc276592840193219c07293021edc12c92196f95
SHA256d4d0a97ef753de04453f8dbf689331d86724370d995a4bb95df65ab6a24eb3de
SHA5128f9eb0d366fc1b90d2812ad139cf9da47e536f0241294b4c758c2199a00362ad02a3c98267c03092491a2aec741c6c7d4c7a34c672294e617375b87e9e041e70
-
Filesize
23KB
MD5c7384185d389c3719dfe3d61267a0d91
SHA1a7c63b5eb3d6cdb51029e5b7bc899264de28b17e
SHA256e39970bfb3724abd75dea3351b4145326ad40df09a1724459188b0520293d21d
SHA512021c8330fcee56da2ecaa27dfc18a2f3d086055958f6d85df68d51ea489a2fc1c18cd741b8454b20eab54c5479bb8e2ce8574e014294f67d9cf074540c665dba
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04