Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe
Resource
win7-20240903-en
General
-
Target
7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe
-
Size
886KB
-
MD5
f508abf920fbd52e54dba67bcfd561ba
-
SHA1
e4b6476bbb722f0c6513284d827b9290d6056489
-
SHA256
7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853
-
SHA512
fcfb71e4745b40d5a0366295202bc1732578c38adb2ec605938ebb5fe06f4c9fa64e090a4d713453fed17bea3c3fe34f9342ee10c69b00ce9206fd4527c34ca3
-
SSDEEP
24576:6qyd9G4LZ5fO7p9zgAAdsyyq4ZZsVoAc:8d9G4tA9gAAdsdq4HV/
Malware Config
Extracted
xloader
2.5
qr26
libreriarenemoreno.com
searingrofivt.xyz
liveincare-online.com
nahda92.com
oki-net.com
onlinedelivery.biz
marianiartspace.online
wildeblum.biz
adelaideofficeinteriors.com
plickthepick.com
qhyingtu.com
enjoy2m.xyz
037yu.xyz
poseidonvips.com
intricatepainting.com
cwdestore.com
nordic-aesthetics.com
80cq926.top
arbiz.farm
yun183.xyz
onboardaltdigitalavg.rest
daidalo.com
hnjst.net
mothersmilktn.com
sixfigurefundamentals.com
sentpostja.com
moonsonkashback.xyz
primelinedistanc.ltd
someglimpses.com
omniahgames.com
shabupaperpot.com
shepinhang.net
dcfrc.com
goldenrhythm.com
watchonlineplay.xyz
brisbanecarcollectors.com
northernlightdebtrelief.com
mmnbm.com
localmarketagents.com
alba-laser.com
miamitaxes1040.com
internaturalestetik.com
konjophotos.com
smartsew.online
jack-barbara-memorial.com
mimihin.com
cahc.info
vanlifedubai.com
sogu.one
phpmv.com
colorfulfluidchaos.com
sfheatpumps.com
mintbox.pro
sugarkelly.com
testimonial.direct
albayscofield.club
1ees.com
enrevologix.com
birchbayapartments.com
kincsemto.net
toptraveltouch.com
arrowelectronics-corp.net
institutozavaleta.com
stoneprodirectory.com
iwjvit.com
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/2760-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2516 set thread context of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2760 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31 PID 2516 wrote to memory of 2760 2516 7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"C:\Users\Admin\AppData\Local\Temp\7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2760
-