Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
Enquiry#List For Urgent Order070521.exe
Resource
win7-20240903-en
General
-
Target
Enquiry#List For Urgent Order070521.exe
-
Size
1.3MB
-
MD5
b65d348c6c626693fda8657edb8edd5a
-
SHA1
a080850656a7eb65b6a21a8d23d8a5df9cf5df78
-
SHA256
c6e9c8aafd1bcd3b7772547cb5fe8c52b57a7486b93172163478fb0974725ac9
-
SHA512
db85fb23836b5caeb9abf6a56f3ac336a1423394708e188f5e991c7119ff2a44c16451f476d882bc927fe4b8397fee28e83ee69f368441036189094321a437b9
-
SSDEEP
12288:OSbd6NsB+OaDaDaOIrDBQtKY3YZ/ZHRjrJjCNFhVN1UayaE:O+6NJOaDaDa7l7Y3YZ3jrQFtuayaE
Malware Config
Extracted
xloader
2.3
rnn4
saruroman.com
backendfurnitureconsulting.com
invitadito.com
aqemelearning.com
unitedphonerepair.com
xn--l6qt3dk7equidt4a.net
us-pride-day.com
refund.homes
gilanfarrconstruction.com
856380691.xyz
aerolabqhd.com
collective36.com
binhminhxanh.club
droogskateboards.com
thinkbest11.com
realisticallywritten.com
elderlyjustification.com
betteraff.net
freeworkpays.com
callistatease.com
thesocialbear.com
soufenxiang.com
keep-it-smart.com
nybullets.com
beautytheoryedu.com
meloncholica.com
retrolyside.com
5gxfezaf93h9r.net
finleyspex.com
challengerburgess.agency
ants.trade
granitestatepsych.com
canadainvestor.net
eevmobile.com
gyaankapoint.com
iblueberryusa.com
digitalhubgroup.net
bonap56.com
sharigrande.com
narclist.com
aahdr.delivery
brilliantpeople.net
distillerialessinia.com
digitalcurrencypost.com
foods.systems
virtualgrandrapidsboatshow.com
starbladi.com
indigoconsultinguganda.com
terratwelve.com
connectshinerise.com
breakthrough-community.com
vicdux.network
aidah.chat
cubicaje.store
deepkeeladvisory.com
superscarwash.com
cfcfoods.com
buddycritic.com
loveyourprinters.com
uvx.pink
yhss.xyz
blog-asunaro.com
ykznb.com
organicwinepromos.com
ydhchina.com
Signatures
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral2/memory/956-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/956-18-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/4812-23-0x00000000007D0000-0x00000000007F8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3764 set thread context of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 956 set thread context of 3500 956 Enquiry#List For Urgent Order070521.exe 55 PID 4812 set thread context of 3500 4812 chkdsk.exe 55 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Enquiry#List For Urgent Order070521.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 956 Enquiry#List For Urgent Order070521.exe 956 Enquiry#List For Urgent Order070521.exe 956 Enquiry#List For Urgent Order070521.exe 956 Enquiry#List For Urgent Order070521.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe 4812 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 956 Enquiry#List For Urgent Order070521.exe 956 Enquiry#List For Urgent Order070521.exe 956 Enquiry#List For Urgent Order070521.exe 4812 chkdsk.exe 4812 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 956 Enquiry#List For Urgent Order070521.exe Token: SeDebugPrivilege 4812 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3764 wrote to memory of 956 3764 Enquiry#List For Urgent Order070521.exe 91 PID 3500 wrote to memory of 4812 3500 Explorer.EXE 92 PID 3500 wrote to memory of 4812 3500 Explorer.EXE 92 PID 3500 wrote to memory of 4812 3500 Explorer.EXE 92 PID 4812 wrote to memory of 1104 4812 chkdsk.exe 93 PID 4812 wrote to memory of 1104 4812 chkdsk.exe 93 PID 4812 wrote to memory of 1104 4812 chkdsk.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\Enquiry#List For Urgent Order070521.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry#List For Urgent Order070521.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\Enquiry#List For Urgent Order070521.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry#List For Urgent Order070521.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Enquiry#List For Urgent Order070521.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1104
-
-