Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 19:08
Behavioral task
behavioral1
Sample
8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe
Resource
win10v2004-20241007-en
General
-
Target
8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe
-
Size
4.8MB
-
MD5
9384a0735fc13a99b539f6dd056c6440
-
SHA1
497390cac868697a67135216d4da8dfac0e54856
-
SHA256
8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883c
-
SHA512
4bc4bd244fb090f84482f93dc356c22f95fb8c419d0ca8ebdcf5d725ebf6a5df645fa7fc4eb903554528d5c498d409b1573b9336b9deb0f614f24452bea5c66b
-
SSDEEP
98304:2nsmtk2aJ3xL6eQhbL3l+Ug7n8fRnWC9t1cCGP7KrNlMVEK7Az+7HHy:oLImeQ7+lbUt5RxSVnaOy
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x00060000000194c6-107.dat -
Executes dropped EXE 5 IoCs
pid Process 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 1940 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp 2356 Synaptics.exe 2384 ._cache_Synaptics.exe 2336 ._cache_Synaptics.tmp -
Loads dropped DLL 7 IoCs
pid Process 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 2356 Synaptics.exe 2356 Synaptics.exe 2384 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2688 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1940 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp 2336 ._cache_Synaptics.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2688 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 1596 wrote to memory of 2488 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 28 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 2488 wrote to memory of 1940 2488 ._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 29 PID 1596 wrote to memory of 2356 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 30 PID 1596 wrote to memory of 2356 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 30 PID 1596 wrote to memory of 2356 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 30 PID 1596 wrote to memory of 2356 1596 8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe 30 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2356 wrote to memory of 2384 2356 Synaptics.exe 31 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32 PID 2384 wrote to memory of 2336 2384 ._cache_Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe"C:\Users\Admin\AppData\Local\Temp\8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\is-LCE8N.tmp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp"C:\Users\Admin\AppData\Local\Temp\is-LCE8N.tmp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp" /SL5="$7015A,3788295,227328,C:\Users\Admin\AppData\Local\Temp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1940
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\is-HDJCN.tmp\._cache_Synaptics.tmp"C:\Users\Admin\AppData\Local\Temp\is-HDJCN.tmp\._cache_Synaptics.tmp" /SL5="$201DA,3788295,227328,C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2336
-
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD59384a0735fc13a99b539f6dd056c6440
SHA1497390cac868697a67135216d4da8dfac0e54856
SHA2568aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883c
SHA5124bc4bd244fb090f84482f93dc356c22f95fb8c419d0ca8ebdcf5d725ebf6a5df645fa7fc4eb903554528d5c498d409b1573b9336b9deb0f614f24452bea5c66b
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD524e2d5e7f8eeeef1734c89b0b605749b
SHA1db05982d005c47311491ed7913719567edfc422d
SHA2560cd9d5b9e9d207ec0850e0fe0f1691c1e2865decd40147c7b1f65602204a5371
SHA5124e340447c31ecd08db9d7ac2cf609426fc25f4909fe3b96118be4564c36ce79ea03ea69c76cb4e983c6006b59000a62f91855d83d3d6196745b0082193cc477b
-
Filesize
29KB
MD5d49f1ed04de368bf81756ca09b7935a4
SHA10b0afe70bf1cd8eda51ee9c1c7ba0075bae086e1
SHA256c5a8e090dbfb2147442de02eca4b829c8717c4b7fca4ee079b5bc7c2e34319f1
SHA512cd5eff1ce3ef40ca92828416819339dad80aa3f3bf38932780adb1194127d5ad077a0223e8d56983d3cd134e086c113108a0a0d72b0ccd797c1d2c3c9ae0cb27
-
Filesize
28KB
MD5882108f6bc82f4aab1d16982275d2f7c
SHA1f5433561929beca1b866024d812f28946b0b342b
SHA2561d3e9aa75d3d7ae23429bae1e0857f154660f24110503b58cccd142727671a66
SHA512060796931899fedf575e01d72092e6451490a6ff0923a890674bdc45d434f022c227ecb00175a6f5279401f10edfd13304dcba8db94b787653630b06b0d861c3
-
\Users\Admin\AppData\Local\Temp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.exe
Filesize4.0MB
MD5f2f0f372ec02d97e3770fa7cb20416d5
SHA140d658ef24e2ccc48e44685b233fae7563140738
SHA2562ac7d09aee7ac018af3c6ecd1e6afcb768dfdaaee29c15e5671a2546744c0526
SHA512525f0efa927c6b10795800622defb83c9badfe4e2a9125791c2aad672df7a5db842e544870f476b5924a7be7fd4b4244ed0d49f809df1d20235219235e246c3d
-
\Users\Admin\AppData\Local\Temp\is-LCE8N.tmp\._cache_8aadfdd433f8ede5fd88bc465b4cf19d8b6083caadc5b0f41502bb6e2105883cN.tmp
Filesize1.2MB
MD56a144d451bed469456c5398afbacd260
SHA1e4b049e19ba6f537651720423df4b365e0f95e1c
SHA25661b642a01bfa8ea1a100241fc1b57b016b23e769cabc321f22ad5f7d4e37443c
SHA512f2e9cc45765dcceaa8e818a7046de5c1c5b486678e7826d5460632a66e6907bfa6ca94fa78ef85706d5e9e86ba0e02ad3b771f76afab3df3ebca60b82fda66c8