Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
ComparisonComparer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ComparisonComparer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
po.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
po.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
poo.exe
Resource
win7-20240903-en
General
-
Target
poo.exe
-
Size
974KB
-
MD5
a7a7e5941f4485610a7f41704f00e421
-
SHA1
e47fea20cc78309942ff1c977b31e0a0d978a487
-
SHA256
edcb88871a091cde75e0e6aca09a4ff4781d3855e0a96112544366309bf2cc79
-
SHA512
2722ead790d09addf580db38b768b64831d5c2a19a3fd0d245315f132b227479a12785115118e4d2b36dfd184729634c667238a53157877e069d093ea0155687
-
SSDEEP
24576:yJLg4ZL5lnb78HeIpHNxLa+Hq6oDuGpOJhd7middX:g8mrMHeIpX++KFiGkrd7midd
Malware Config
Extracted
xloader
2.3
sjgd
hjtzzg.com
arabiaprogram.com
hana-pet.com
jointreleif911.com
superuglycakes.com
f5gcpxgfs3rkf.net
bentengproperti.com
josiewalter.com
nallove.com
contorig2.com
kruberm.com
wcieckashmir.com
syggao.com
rollinproduction.com
furiael.online
harasalcancu.com
cesarscott.com
high5promotions.com
bemagicnottragic.com
orangeapron.net
thegiftofyourstory.com
mynewbuildhome.com
practicalfitnessidea.com
arkanlune.com
upmcmhealthplan.com
skyabovelog.com
yawicanada.com
hxmeirong.com
vacation-all-inclusive.com
candoubaoku.com
xiangche360.com
rce.cool
nqwydhxgrw.com
assistance-technique.info
444999dy.com
faktacount.com
foggylife.com
underneathberlin.com
wy1687.com
liveblanch.life
childvictimsactinfo.com
portalmedan.com
tomwanamaker.net
homeoffice-musthaves.com
mano.one
minahapshy.com
vedgc.com
thegoodcaptain.net
uniccodocs.com
centerdecorstore.com
mein-business.online
9f1.net
pathwaytopurposetherapy.com
nyhtgj88.com
troels1.com
fashionblessings.com
donatebtc.info
sparta-mc.online
520age.com
agaragar.info
leeindustrles.com
couttsagency.com
telemedspain.com
industry-automation.com
holodov.net
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral5/memory/1788-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral5/memory/1788-17-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral5/memory/1788-21-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral5/memory/1044-27-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
pid Process 1784 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1964 set thread context of 1788 1964 poo.exe 31 PID 1788 set thread context of 1208 1788 poo.exe 21 PID 1788 set thread context of 1208 1788 poo.exe 21 PID 1044 set thread context of 1208 1044 netsh.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language poo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1964 poo.exe 1964 poo.exe 1788 poo.exe 1788 poo.exe 1788 poo.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe 1044 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1788 poo.exe 1788 poo.exe 1788 poo.exe 1788 poo.exe 1044 netsh.exe 1044 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1964 poo.exe Token: SeDebugPrivilege 1788 poo.exe Token: SeDebugPrivilege 1044 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1964 wrote to memory of 1788 1964 poo.exe 31 PID 1788 wrote to memory of 1044 1788 poo.exe 32 PID 1788 wrote to memory of 1044 1788 poo.exe 32 PID 1788 wrote to memory of 1044 1788 poo.exe 32 PID 1788 wrote to memory of 1044 1788 poo.exe 32 PID 1044 wrote to memory of 1784 1044 netsh.exe 33 PID 1044 wrote to memory of 1784 1044 netsh.exe 33 PID 1044 wrote to memory of 1784 1044 netsh.exe 33 PID 1044 wrote to memory of 1784 1044 netsh.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\poo.exe"C:\Users\Admin\AppData\Local\Temp\poo.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\poo.exe"C:\Users\Admin\AppData\Local\Temp\poo.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\poo.exe"5⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1784
-
-
-
-