Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
Scope of Work.exe
Resource
win7-20240903-en
General
-
Target
Scope of Work.exe
-
Size
739KB
-
MD5
8bb595e02dac37f067a5f159c056b939
-
SHA1
831ac2fde895feed37bfdb54596246dd74cde684
-
SHA256
fa34b787daecd743a4def20fdf8901838458c8311ba9bbb5fbd650ff48841cf9
-
SHA512
aa42299ece48b9eb03e1b1ef72f2614951b0244a5497f7e90dc8b8d5a3616c8a66659bedc44bd4399552f61d51d26690d30ab894de35a8cae935c75067e769da
-
SSDEEP
12288:tQ9kK6UTQX5cwHgAM2EPmK7WjS/TXKjoqtq/hmz088+wSoiZEb/zHfaBtRoMkxc7:EkWTQXyv1xgjjJU+CX9M
Malware Config
Extracted
xloader
2.5
m3ci
424964.com
ocean-breath-retreat.com
icidedansdehors.art
wrochtthurl.quest
6455gfg.top
dgfipmailservice.online
banjofarmenica.com
dkcazin.com
jobs-fp.com
karens-kornerr.com
parmaesq.com
nuevochile.net
inputsquad.com
consultacedula-sep.digital
taogoubao.net
gimmesolar.com
bluelacedefense.com
grandagent.club
warqatalzawaj.com
getvirbelanow.com
omnifichub.com
rjtherealest.com
hqpzchmo.xyz
pearl-street-art.com
dudukrumah.com
resetmybutton.info
dinodao.xyz
payment-securecard.com
gorjessbyjessicaservice.website
edayispeove.com
glorian34.com
moviezwaphd.red
bxqiche.com
associate-cien.com
coparivan.quest
buyseneca.com
del-directory.xyz
thedarkhuntressexperience.com
trevaleaf.com
kwsi.online
2552111.com
highpacts.com
queenslandspirits.com
magazinhaberlerim.com
radialodge.com
packgames.store
sterre.one
tkspoboys.com
datashen.com
xn--4gqyn781iuoq.xyz
breadnbutterflies.com
intotheground.net
tenlog043.xyz
bendingwillowbirth.com
lavellwesley.com
aumpatho.com
fdklflkdioerklfdke.store
nxscrapbook.com
dan-is-a-ghey-retard.com
retailzoohub.com
pause-beautystore.com
accentpavementmaintenance.com
brittsballers.com
indev-mobility.info
bravobug.net
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral2/memory/2364-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2364-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2364-22-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3956-30-0x0000000000EA0000-0x0000000000EC9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 5020 set thread context of 2364 5020 Scope of Work.exe 97 PID 2364 set thread context of 3540 2364 RegSvcs.exe 56 PID 2364 set thread context of 3540 2364 RegSvcs.exe 56 PID 3956 set thread context of 3540 3956 rundll32.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scope of Work.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe 3956 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 2364 RegSvcs.exe 3956 rundll32.exe 3956 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5020 Scope of Work.exe Token: SeDebugPrivilege 2364 RegSvcs.exe Token: SeDebugPrivilege 3956 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 5020 wrote to memory of 2364 5020 Scope of Work.exe 97 PID 3540 wrote to memory of 3956 3540 Explorer.EXE 100 PID 3540 wrote to memory of 3956 3540 Explorer.EXE 100 PID 3540 wrote to memory of 3956 3540 Explorer.EXE 100 PID 3956 wrote to memory of 800 3956 rundll32.exe 102 PID 3956 wrote to memory of 800 3956 rundll32.exe 102 PID 3956 wrote to memory of 800 3956 rundll32.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\Scope of Work.exe"C:\Users\Admin\AppData\Local\Temp\Scope of Work.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:800
-
-