Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
Scope of Work.exe
Resource
win7-20240903-en
General
-
Target
Scope of Work.exe
-
Size
739KB
-
MD5
8bb595e02dac37f067a5f159c056b939
-
SHA1
831ac2fde895feed37bfdb54596246dd74cde684
-
SHA256
fa34b787daecd743a4def20fdf8901838458c8311ba9bbb5fbd650ff48841cf9
-
SHA512
aa42299ece48b9eb03e1b1ef72f2614951b0244a5497f7e90dc8b8d5a3616c8a66659bedc44bd4399552f61d51d26690d30ab894de35a8cae935c75067e769da
-
SSDEEP
12288:tQ9kK6UTQX5cwHgAM2EPmK7WjS/TXKjoqtq/hmz088+wSoiZEb/zHfaBtRoMkxc7:EkWTQXyv1xgjjJU+CX9M
Malware Config
Extracted
xloader
2.5
m3ci
424964.com
ocean-breath-retreat.com
icidedansdehors.art
wrochtthurl.quest
6455gfg.top
dgfipmailservice.online
banjofarmenica.com
dkcazin.com
jobs-fp.com
karens-kornerr.com
parmaesq.com
nuevochile.net
inputsquad.com
consultacedula-sep.digital
taogoubao.net
gimmesolar.com
bluelacedefense.com
grandagent.club
warqatalzawaj.com
getvirbelanow.com
omnifichub.com
rjtherealest.com
hqpzchmo.xyz
pearl-street-art.com
dudukrumah.com
resetmybutton.info
dinodao.xyz
payment-securecard.com
gorjessbyjessicaservice.website
edayispeove.com
glorian34.com
moviezwaphd.red
bxqiche.com
associate-cien.com
coparivan.quest
buyseneca.com
del-directory.xyz
thedarkhuntressexperience.com
trevaleaf.com
kwsi.online
2552111.com
highpacts.com
queenslandspirits.com
magazinhaberlerim.com
radialodge.com
packgames.store
sterre.one
tkspoboys.com
datashen.com
xn--4gqyn781iuoq.xyz
breadnbutterflies.com
intotheground.net
tenlog043.xyz
bendingwillowbirth.com
lavellwesley.com
aumpatho.com
fdklflkdioerklfdke.store
nxscrapbook.com
dan-is-a-ghey-retard.com
retailzoohub.com
pause-beautystore.com
accentpavementmaintenance.com
brittsballers.com
indev-mobility.info
bravobug.net
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/2860-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2860-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2860-22-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2668-29-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1696 set thread context of 2860 1696 Scope of Work.exe 31 PID 2860 set thread context of 1152 2860 RegSvcs.exe 20 PID 2860 set thread context of 1152 2860 RegSvcs.exe 20 PID 2668 set thread context of 1152 2668 wininit.exe 20 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scope of Work.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2860 RegSvcs.exe 2860 RegSvcs.exe 2860 RegSvcs.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe 2668 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2860 RegSvcs.exe 2860 RegSvcs.exe 2860 RegSvcs.exe 2860 RegSvcs.exe 2668 wininit.exe 2668 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1696 Scope of Work.exe Token: SeDebugPrivilege 2860 RegSvcs.exe Token: SeDebugPrivilege 2668 wininit.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1696 wrote to memory of 2860 1696 Scope of Work.exe 31 PID 1152 wrote to memory of 2668 1152 Explorer.EXE 32 PID 1152 wrote to memory of 2668 1152 Explorer.EXE 32 PID 1152 wrote to memory of 2668 1152 Explorer.EXE 32 PID 1152 wrote to memory of 2668 1152 Explorer.EXE 32 PID 2668 wrote to memory of 2644 2668 wininit.exe 33 PID 2668 wrote to memory of 2644 2668 wininit.exe 33 PID 2668 wrote to memory of 2644 2668 wininit.exe 33 PID 2668 wrote to memory of 2644 2668 wininit.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\Scope of Work.exe"C:\Users\Admin\AppData\Local\Temp\Scope of Work.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2644
-
-