Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order 4500447701.exe
Resource
win7-20240729-en
General
-
Target
Purchase order 4500447701.exe
-
Size
559KB
-
MD5
2dc28d7d605c0da46b7c7f767561a057
-
SHA1
300f76a7cc13648f00ffb3baa12c51a71adb8395
-
SHA256
7ed1db0b1bfb7845bc63e83b7408bd8c475f3173cb0942325663cda742de0a26
-
SHA512
875c7ed14b4b47e1cc56876871153ec3f47374e759aca8e9fba9ac681baf19a96b47233f0159327c37dadf2c9d70817acfeb90e70bf6eda9d60616ddf941375f
-
SSDEEP
12288:5Xs1g8To3GZrA/XWLXYzTHTpNzfSNmc7seOep6K:dnzpNzqNh77
Malware Config
Extracted
xloader
2.3
h6fe
fortirecon.com
owlions.com
openrhodes.net
hannahjohnston.com
legacyfreshmarket.com
themedicareenroll.com
hpondsmarket.com
2manyads.com
kiralikservis.com
oxfordprinters.com
yamalo.club
apagyms.com
gulsahdevarsiv.com
employmentpakistan.com
insidegamez.com
curiget.xyz
pinturayanexo.com
myltcpool.com
greenfirewoodash.com
gabrielaalcantarperiodista.com
7856353.com
thefrozendeserts.com
alienblacque.com
arcticsnowmobiles.com
perfectingwealth.com
sjaikikai.com
healthylooksbeautiful.com
carrieblackshaw.com
commercexm.com
covidpreventionshop.com
kktee.net
ledlighting-en.com
vr1234.chat
istanbulplastic.com
gcsapartners.com
app-confirmation.com
schluesseldienst-nuernberg.info
xhxet.com
archanashahofficial.com
wiloasbanhsgtarewdasc.solutions
sani-ball.com
tlctrueloveconnection.com
teambuddhashirts.com
ravibags.com
whocanteachme.com
antoniosabato.info
hbfrolin.com
resilientairecircle.com
cookiesvegasdispensary.com
vinhorapido.com
brazilpe.com
dynamic-strategies.com
daxuangou.com
aneshinchi.info
danielsfencellc.com
proactol-information.com
ka1288.com
xn--pckuay0l6a7c.site
youngdigitalpartners.com
adophile.com
marycieloingrid.com
drsimaipediatrics.com
nostophobia.com
pkillian.com
reisentuerkei.com
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/1512-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1512-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1512-22-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2080-28-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
pid Process 1424 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1760 set thread context of 1512 1760 Purchase order 4500447701.exe 31 PID 1512 set thread context of 1320 1512 Purchase order 4500447701.exe 21 PID 1512 set thread context of 1320 1512 Purchase order 4500447701.exe 21 PID 2080 set thread context of 1320 2080 svchost.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purchase order 4500447701.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1760 Purchase order 4500447701.exe 1760 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1512 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 1512 Purchase order 4500447701.exe 2080 svchost.exe 2080 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1760 Purchase order 4500447701.exe Token: SeDebugPrivilege 1512 Purchase order 4500447701.exe Token: SeDebugPrivilege 2080 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1760 wrote to memory of 1512 1760 Purchase order 4500447701.exe 31 PID 1320 wrote to memory of 2080 1320 Explorer.EXE 32 PID 1320 wrote to memory of 2080 1320 Explorer.EXE 32 PID 1320 wrote to memory of 2080 1320 Explorer.EXE 32 PID 1320 wrote to memory of 2080 1320 Explorer.EXE 32 PID 2080 wrote to memory of 1424 2080 svchost.exe 33 PID 2080 wrote to memory of 1424 2080 svchost.exe 33 PID 2080 wrote to memory of 1424 2080 svchost.exe 33 PID 2080 wrote to memory of 1424 2080 svchost.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\Purchase order 4500447701.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order 4500447701.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\Purchase order 4500447701.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order 4500447701.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase order 4500447701.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1424
-
-