Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/12/2024, 16:23
Behavioral task
behavioral1
Sample
CorFile2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CorFile2.exe
Resource
win10v2004-20241007-en
General
-
Target
CorFile2.exe
-
Size
5.5MB
-
MD5
3a21107631e0d658dc2d1410e20ca9e2
-
SHA1
3ead0bcb35e7f3ece32f3499e7df56e187d0aefa
-
SHA256
56751e9b9254ff63d09164c380208913237270b2ce939cf5edcf271874122c75
-
SHA512
2b29cdbcb3d52f392ab94b207932c4bc643c30199f3671865fad98e76d6103224f80684445759bd4f86e2d401adab19196c73bd5b416150719eac9762c55a1fe
-
SSDEEP
12288:PMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9XKWkj:PnsJ39LyjbJkQFMhmC+6GD96WU
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2604 ._cache_CorFile2.exe 2632 Synaptics.exe 2636 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 1716 CorFile2.exe 1716 CorFile2.exe 1716 CorFile2.exe 1716 CorFile2.exe 2632 Synaptics.exe 2632 Synaptics.exe 2632 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" CorFile2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CorFile2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2604 1716 CorFile2.exe 28 PID 1716 wrote to memory of 2604 1716 CorFile2.exe 28 PID 1716 wrote to memory of 2604 1716 CorFile2.exe 28 PID 1716 wrote to memory of 2604 1716 CorFile2.exe 28 PID 1716 wrote to memory of 2632 1716 CorFile2.exe 29 PID 1716 wrote to memory of 2632 1716 CorFile2.exe 29 PID 1716 wrote to memory of 2632 1716 CorFile2.exe 29 PID 1716 wrote to memory of 2632 1716 CorFile2.exe 29 PID 2632 wrote to memory of 2636 2632 Synaptics.exe 30 PID 2632 wrote to memory of 2636 2632 Synaptics.exe 30 PID 2632 wrote to memory of 2636 2632 Synaptics.exe 30 PID 2632 wrote to memory of 2636 2632 Synaptics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\CorFile2.exe"C:\Users\Admin\AppData\Local\Temp\CorFile2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\._cache_CorFile2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_CorFile2.exe"2⤵
- Executes dropped EXE
PID:2604
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2636
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD53a21107631e0d658dc2d1410e20ca9e2
SHA13ead0bcb35e7f3ece32f3499e7df56e187d0aefa
SHA25656751e9b9254ff63d09164c380208913237270b2ce939cf5edcf271874122c75
SHA5122b29cdbcb3d52f392ab94b207932c4bc643c30199f3671865fad98e76d6103224f80684445759bd4f86e2d401adab19196c73bd5b416150719eac9762c55a1fe
-
Filesize
4.8MB
MD5f22c47f8227ad36a3d0026dae2307388
SHA19c4fb6779174b5725e9d2078f4fdc4cf90522b20
SHA2560ea4fb4b62a5826b1640e2a7018aa0c01119381d4320b46c9870e19cdfb557f9
SHA5129d2276b56e4b6779643eae15922a3c489bc23bbbc15b9ef1132305f5964e1aa635ae4e82463bd79c6d6fb49e1f9dadb63bcb19d97480a1776bf96b83fb2706b6