Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 15:46
Behavioral task
behavioral1
Sample
3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe
Resource
win10v2004-20241007-en
General
-
Target
3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe
-
Size
1.2MB
-
MD5
b0f3d67ce3a2bcb8d4d2bfbef5fc2910
-
SHA1
84220d50882074e7aeeeb8c57615c73030756525
-
SHA256
3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011
-
SHA512
cb41ee262d3f0235b318438dfa63f5dea379e27f78b28d0d379b38abfdee8b740ac7faaa06d59f71836f85171d65c64b6a402aaad27fc2dc87ff85df92e2deae
-
SSDEEP
24576:rnsJ39LyjbJkQFMhmC+6GD95gkRExMcCPwxJxCk:rnsHyjtk2MYC5GDAdxlCQqk
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2784 ._cache_3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 2540 Synaptics.exe 1708 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 2540 Synaptics.exe 2540 Synaptics.exe 2540 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3044 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3044 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2784 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 30 PID 2764 wrote to memory of 2784 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 30 PID 2764 wrote to memory of 2784 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 30 PID 2764 wrote to memory of 2784 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 30 PID 2764 wrote to memory of 2540 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 31 PID 2764 wrote to memory of 2540 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 31 PID 2764 wrote to memory of 2540 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 31 PID 2764 wrote to memory of 2540 2764 3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe 31 PID 2540 wrote to memory of 1708 2540 Synaptics.exe 32 PID 2540 wrote to memory of 1708 2540 Synaptics.exe 32 PID 2540 wrote to memory of 1708 2540 Synaptics.exe 32 PID 2540 wrote to memory of 1708 2540 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe"C:\Users\Admin\AppData\Local\Temp\3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\._cache_3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b0f3d67ce3a2bcb8d4d2bfbef5fc2910
SHA184220d50882074e7aeeeb8c57615c73030756525
SHA2563d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011
SHA512cb41ee262d3f0235b318438dfa63f5dea379e27f78b28d0d379b38abfdee8b740ac7faaa06d59f71836f85171d65c64b6a402aaad27fc2dc87ff85df92e2deae
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
\Users\Admin\AppData\Local\Temp\._cache_3d3cc534db1f2ad1452c0eb794a882e834bdb9feee3674bf08ac117b73dbe011N.exe
Filesize450KB
MD5444976d66cdd165d6f50b5b750d13532
SHA1df5b4ce21fb6046703cb57ff3a05ec4e43188f99
SHA25608433ce924d3cf275614275278fc7af0911929a3b3522f1417ff1b0bb2556679
SHA512ec0a91d4ce511a7743c11a533999f6b23370e4f459603e2a39d558f7594d9a171953a37ada95b02321ed5860879702b0cde1f1f94a4cf4ffb0afa11178a2710a