Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2024, 11:43
Behavioral task
behavioral1
Sample
3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Resource
win10v2004-20241007-en
General
-
Target
3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
-
Size
4.6MB
-
MD5
d8734a9286d0a51bc1f0a37ddfc35344
-
SHA1
75a5954e9762a09d6dfd638907a416b8f2bfb656
-
SHA256
3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e
-
SHA512
51c7d06a0cabc7ddbb22400b510c9abb7695de43da20c83bac4efb06f3b4466dce9cd23c87e17649c478e8386116fe1dc0a9af575fe2694104e8f129231919dc
-
SSDEEP
49152:knsHyjtk2MYC5GDd1GtQfUZ53MQD7typ+VeQWwbM7FDC/5xKyzKC8aJBVE2+ofHZ:knsmtk2aStCtD7tNPKyuC53+2+ofh/wi
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4160 ._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 4176 Synaptics.exe 2844 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2928 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 EXCEL.EXE 2928 EXCEL.EXE 2928 EXCEL.EXE 2928 EXCEL.EXE 2928 EXCEL.EXE 2928 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1156 wrote to memory of 4160 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 82 PID 1156 wrote to memory of 4160 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 82 PID 1156 wrote to memory of 4160 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 82 PID 1156 wrote to memory of 4176 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 83 PID 1156 wrote to memory of 4176 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 83 PID 1156 wrote to memory of 4176 1156 3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe 83 PID 4176 wrote to memory of 2844 4176 Synaptics.exe 84 PID 4176 wrote to memory of 2844 4176 Synaptics.exe 84 PID 4176 wrote to memory of 2844 4176 Synaptics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"C:\Users\Admin\AppData\Local\Temp\3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"C:\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4160
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD5d8734a9286d0a51bc1f0a37ddfc35344
SHA175a5954e9762a09d6dfd638907a416b8f2bfb656
SHA2563386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e
SHA51251c7d06a0cabc7ddbb22400b510c9abb7695de43da20c83bac4efb06f3b4466dce9cd23c87e17649c478e8386116fe1dc0a9af575fe2694104e8f129231919dc
-
C:\Users\Admin\AppData\Local\Temp\._cache_3386bdb8aa5d8fe70de357c179018803da064ac6478ba810b915f29aa229462e.exe
Filesize3.9MB
MD58ccc41b8aff48c2d933603cc6209260a
SHA1d84f1fef3a8b029cd14d2015ec88f804186d94f8
SHA25683c2d22f495011f4a4524791c38382b8011803e2e50c274e6d02a510cd6b6baf
SHA512856c08cb392a09c48306c83ad917f312f1b9ede90aa60253752c4d35d5525301d0c958d6bcb535d4ffcc9faab5638140103a1b7f81f2539b3acc6c9b7bbcafab
-
Filesize
26KB
MD5cf346c7be07a9341beceb3fc8c2fc72a
SHA167e6460ad06c19920b3b3c612d8400bb58757c14
SHA256012c449839a989750309c1e9f3bd0a90f5acb3d71e77c331ab87a7928b91dc43
SHA512c7d19b15d98dda8ae6e34eb54741e6173a38833db9bb4953218411d98ba338f215bfdb9995f7a694a98264be656fd5091bee5bec3960e1737f4b129048335b99
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04