Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
10s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 22:59
Behavioral task
behavioral1
Sample
000.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
000.exe
-
Size
7.4MB
-
MD5
06c9504a38c6996916dbd515559c9564
-
SHA1
33e92f8c6dd8b3eab4b06ca0bb428e48b4504dac
-
SHA256
2fbd716ca1f19737591463a9f5776de57105fd800118375012d08fb000d2e39e
-
SHA512
e9259b0ebcf970db693af90a8811e706ef10187c33d662409c678034abdf5282a1bd63e1a6445c25f35a0c7714863109a17289e1919d9ad268ba72fc4f6f792f
-
SSDEEP
12288:cMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Jt1I2rVvWHuuuvj:cnsJ39LyjbJkQFMhmC+6GD9j1dUuuu7
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
pid Process 2652 ._cache_000.exe 2256 Synaptics.exe 2820 ._cache_Synaptics.exe -
Loads dropped DLL 10 IoCs
pid Process 3016 000.exe 3016 000.exe 3016 000.exe 2256 Synaptics.exe 2256 Synaptics.exe 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe 556 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 000.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: ._cache_000.exe File opened (read-only) \??\A: ._cache_000.exe File opened (read-only) \??\N: ._cache_000.exe File opened (read-only) \??\O: ._cache_000.exe File opened (read-only) \??\Q: ._cache_000.exe File opened (read-only) \??\S: ._cache_000.exe File opened (read-only) \??\B: ._cache_000.exe File opened (read-only) \??\I: ._cache_000.exe File opened (read-only) \??\M: ._cache_000.exe File opened (read-only) \??\P: ._cache_000.exe File opened (read-only) \??\Y: ._cache_000.exe File opened (read-only) \??\E: ._cache_000.exe File opened (read-only) \??\L: ._cache_000.exe File opened (read-only) \??\R: ._cache_000.exe File opened (read-only) \??\U: ._cache_000.exe File opened (read-only) \??\W: ._cache_000.exe File opened (read-only) \??\X: ._cache_000.exe File opened (read-only) \??\Z: ._cache_000.exe File opened (read-only) \??\G: ._cache_000.exe File opened (read-only) \??\H: ._cache_000.exe File opened (read-only) \??\J: ._cache_000.exe File opened (read-only) \??\K: ._cache_000.exe File opened (read-only) \??\V: ._cache_000.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" ._cache_000.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper ._cache_000.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 556 2820 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 2 IoCs
pid Process 1392 taskkill.exe 2976 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico" ._cache_000.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2976 taskkill.exe Token: SeDebugPrivilege 1392 taskkill.exe Token: SeIncreaseQuotaPrivilege 372 WMIC.exe Token: SeSecurityPrivilege 372 WMIC.exe Token: SeTakeOwnershipPrivilege 372 WMIC.exe Token: SeLoadDriverPrivilege 372 WMIC.exe Token: SeSystemProfilePrivilege 372 WMIC.exe Token: SeSystemtimePrivilege 372 WMIC.exe Token: SeProfSingleProcessPrivilege 372 WMIC.exe Token: SeIncBasePriorityPrivilege 372 WMIC.exe Token: SeCreatePagefilePrivilege 372 WMIC.exe Token: SeBackupPrivilege 372 WMIC.exe Token: SeRestorePrivilege 372 WMIC.exe Token: SeShutdownPrivilege 372 WMIC.exe Token: SeDebugPrivilege 372 WMIC.exe Token: SeSystemEnvironmentPrivilege 372 WMIC.exe Token: SeRemoteShutdownPrivilege 372 WMIC.exe Token: SeUndockPrivilege 372 WMIC.exe Token: SeManageVolumePrivilege 372 WMIC.exe Token: 33 372 WMIC.exe Token: 34 372 WMIC.exe Token: 35 372 WMIC.exe Token: SeIncreaseQuotaPrivilege 372 WMIC.exe Token: SeSecurityPrivilege 372 WMIC.exe Token: SeTakeOwnershipPrivilege 372 WMIC.exe Token: SeLoadDriverPrivilege 372 WMIC.exe Token: SeSystemProfilePrivilege 372 WMIC.exe Token: SeSystemtimePrivilege 372 WMIC.exe Token: SeProfSingleProcessPrivilege 372 WMIC.exe Token: SeIncBasePriorityPrivilege 372 WMIC.exe Token: SeCreatePagefilePrivilege 372 WMIC.exe Token: SeBackupPrivilege 372 WMIC.exe Token: SeRestorePrivilege 372 WMIC.exe Token: SeShutdownPrivilege 372 WMIC.exe Token: SeDebugPrivilege 372 WMIC.exe Token: SeSystemEnvironmentPrivilege 372 WMIC.exe Token: SeRemoteShutdownPrivilege 372 WMIC.exe Token: SeUndockPrivilege 372 WMIC.exe Token: SeManageVolumePrivilege 372 WMIC.exe Token: 33 372 WMIC.exe Token: 34 372 WMIC.exe Token: 35 372 WMIC.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe Token: SeTakeOwnershipPrivilege 2748 WMIC.exe Token: SeLoadDriverPrivilege 2748 WMIC.exe Token: SeSystemProfilePrivilege 2748 WMIC.exe Token: SeSystemtimePrivilege 2748 WMIC.exe Token: SeProfSingleProcessPrivilege 2748 WMIC.exe Token: SeIncBasePriorityPrivilege 2748 WMIC.exe Token: SeCreatePagefilePrivilege 2748 WMIC.exe Token: SeBackupPrivilege 2748 WMIC.exe Token: SeRestorePrivilege 2748 WMIC.exe Token: SeShutdownPrivilege 2748 WMIC.exe Token: SeDebugPrivilege 2748 WMIC.exe Token: SeSystemEnvironmentPrivilege 2748 WMIC.exe Token: SeRemoteShutdownPrivilege 2748 WMIC.exe Token: SeUndockPrivilege 2748 WMIC.exe Token: SeManageVolumePrivilege 2748 WMIC.exe Token: 33 2748 WMIC.exe Token: 34 2748 WMIC.exe Token: 35 2748 WMIC.exe Token: SeIncreaseQuotaPrivilege 2748 WMIC.exe Token: SeSecurityPrivilege 2748 WMIC.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2820 ._cache_Synaptics.exe 2652 ._cache_000.exe 2652 ._cache_000.exe 2820 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2652 3016 000.exe 30 PID 3016 wrote to memory of 2652 3016 000.exe 30 PID 3016 wrote to memory of 2652 3016 000.exe 30 PID 3016 wrote to memory of 2652 3016 000.exe 30 PID 3016 wrote to memory of 2256 3016 000.exe 31 PID 3016 wrote to memory of 2256 3016 000.exe 31 PID 3016 wrote to memory of 2256 3016 000.exe 31 PID 3016 wrote to memory of 2256 3016 000.exe 31 PID 2256 wrote to memory of 2820 2256 Synaptics.exe 32 PID 2256 wrote to memory of 2820 2256 Synaptics.exe 32 PID 2256 wrote to memory of 2820 2256 Synaptics.exe 32 PID 2256 wrote to memory of 2820 2256 Synaptics.exe 32 PID 2652 wrote to memory of 2604 2652 ._cache_000.exe 33 PID 2652 wrote to memory of 2604 2652 ._cache_000.exe 33 PID 2652 wrote to memory of 2604 2652 ._cache_000.exe 33 PID 2652 wrote to memory of 2604 2652 ._cache_000.exe 33 PID 2604 wrote to memory of 2976 2604 cmd.exe 35 PID 2604 wrote to memory of 2976 2604 cmd.exe 35 PID 2604 wrote to memory of 2976 2604 cmd.exe 35 PID 2604 wrote to memory of 2976 2604 cmd.exe 35 PID 2820 wrote to memory of 556 2820 ._cache_Synaptics.exe 36 PID 2820 wrote to memory of 556 2820 ._cache_Synaptics.exe 36 PID 2820 wrote to memory of 556 2820 ._cache_Synaptics.exe 36 PID 2820 wrote to memory of 556 2820 ._cache_Synaptics.exe 36 PID 2604 wrote to memory of 1392 2604 cmd.exe 38 PID 2604 wrote to memory of 1392 2604 cmd.exe 38 PID 2604 wrote to memory of 1392 2604 cmd.exe 38 PID 2604 wrote to memory of 1392 2604 cmd.exe 38 PID 2604 wrote to memory of 372 2604 cmd.exe 39 PID 2604 wrote to memory of 372 2604 cmd.exe 39 PID 2604 wrote to memory of 372 2604 cmd.exe 39 PID 2604 wrote to memory of 372 2604 cmd.exe 39 PID 2604 wrote to memory of 2748 2604 cmd.exe 40 PID 2604 wrote to memory of 2748 2604 cmd.exe 40 PID 2604 wrote to memory of 2748 2604 cmd.exe 40 PID 2604 wrote to memory of 2748 2604 cmd.exe 40 PID 2604 wrote to memory of 616 2604 cmd.exe 41 PID 2604 wrote to memory of 616 2604 cmd.exe 41 PID 2604 wrote to memory of 616 2604 cmd.exe 41 PID 2604 wrote to memory of 616 2604 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\000.exe"C:\Users\Admin\AppData\Local\Temp\000.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\._cache_000.exe"C:\Users\Admin\AppData\Local\Temp\._cache_000.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies WinLogon
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' set FullName='UR NEXT'4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic useraccount where name='Admin' rename 'UR NEXT'4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /f /r /t 04⤵
- System Location Discovery: System Language Discovery
PID:616
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 6604⤵
- Loads dropped DLL
- Program crash
PID:556
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2932
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵PID:2372
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2812
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
MD506c9504a38c6996916dbd515559c9564
SHA133e92f8c6dd8b3eab4b06ca0bb428e48b4504dac
SHA2562fbd716ca1f19737591463a9f5776de57105fd800118375012d08fb000d2e39e
SHA512e9259b0ebcf970db693af90a8811e706ef10187c33d662409c678034abdf5282a1bd63e1a6445c25f35a0c7714863109a17289e1919d9ad268ba72fc4f6f792f
-
Filesize
6.7MB
MD5d5671758956b39e048680b6a8275e96a
SHA133c341130bf9c93311001a6284692c86fec200ef
SHA2564a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
SHA512972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
-
Filesize
403B
MD56fbd6ce25307749d6e0a66ebbc0264e7
SHA1faee71e2eac4c03b96aabecde91336a6510fff60
SHA256e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
SHA51235a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064
-
Filesize
76KB
MD59232120b6ff11d48a90069b25aa30abc
SHA197bb45f4076083fca037eee15d001fd284e53e47
SHA25670faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
SHA512b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877
-
Filesize
81KB
MD5d2774b188ab5dde3e2df5033a676a0b4
SHA16e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA25695374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
SHA5123047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131
-
Filesize
771B
MD5a9401e260d9856d1134692759d636e92
SHA14141d3c60173741e14f36dfe41588bb2716d2867
SHA256b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
SHA5125cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
-
Filesize
396B
MD59037ebf0a18a1c17537832bc73739109
SHA11d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA25638c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
SHA5124fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f