Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 01:58

General

  • Target

    ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe

  • Size

    845KB

  • MD5

    518b14f1482c252d13b28f50a225d68a

  • SHA1

    987fb9b28922364c855700d460799e3dd701dea1

  • SHA256

    ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0

  • SHA512

    5e66ec6a2314a5de421d065131b0c35abda7f0b6468a81e4ebca6850dc3106e3776bb1518b804daaacd3dbf1ab1d584c1f0d1e13e069adf6f8f72116a7274e5d

  • SSDEEP

    12288:RMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9cUq/TjX3DvrnAB3ITPvsA:RnsJ39LyjbJkQFMhmC+6GD9/LKNTZ

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
    "C:\Users\Admin\AppData\Local\Temp\ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"
      2⤵
      • Executes dropped EXE
      PID:2620
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        PID:2848
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    845KB

    MD5

    518b14f1482c252d13b28f50a225d68a

    SHA1

    987fb9b28922364c855700d460799e3dd701dea1

    SHA256

    ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0

    SHA512

    5e66ec6a2314a5de421d065131b0c35abda7f0b6468a81e4ebca6850dc3106e3776bb1518b804daaacd3dbf1ab1d584c1f0d1e13e069adf6f8f72116a7274e5d

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    23KB

    MD5

    d9a9801796062786b8306b1a6e9c1929

    SHA1

    adecccf44d734d7b6f8b736dc74e6323e51f67b2

    SHA256

    cda789eb5bf0c5fa614e4fcf752c3ce93627b1db8feab029712ac3f39a33f4fa

    SHA512

    7bd8aab60a44bb7aae1fc802ed390e2a649d0b67dfe14e06eee98d15beb4723bf7dc49896168da857f112d9b60d8b946063eb92bf296dbe9291bc7a79028095a

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    21KB

    MD5

    2b9095428acc8a81f5a79497e3744f80

    SHA1

    e44b56bf22c3eaf014cda2c1e35f8b7c1db13a62

    SHA256

    0d4f2a016f70b3a754d60d098ea0c7cd8fd12127057e53db958e1872adfb3d09

    SHA512

    f6850665b4cad5f92c2cba0f034d7b46efda471828b5d80836b1a6fdac8a61ee38bea3383993051727c531a1cb1a49a920fc2f2587da53f6b8641f4c2018e349

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    25KB

    MD5

    8c2bffde67893aa2da6a2d0cd61b43d0

    SHA1

    85eaad3b1a54ae50473987a81076ff67606d4258

    SHA256

    56d8a28d4cedb235a5a623a29a7beecbcd79c5b14ee9c3553956f8fd031213c7

    SHA512

    561d5c10780de3c796a82e1a09ca82a8f379b93ecdf6cf357f9b0eff8012763d3eb8a6cc24dfc53fe94ec35a4240fab101fddf6fedbe9d31c7963c0328372fa6

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    21KB

    MD5

    70892e61588fd9899dd78fdcbcce5ff6

    SHA1

    82a24928780dbc8c5ad55750b95ec149a424d16c

    SHA256

    4c8361b36039814f5009cc94288f99c552f20f3bfa58a59cd6ba27415fd31a4b

    SHA512

    ed95daeaa4cf7bf2e411b3ba34e0897758ecee4be2395b229fdbedd0d6d183f54ce46faea2a23d73d98575dd5a4b87d24bcba1494fa839fb340850d8b458ff2a

  • C:\Users\Admin\AppData\Local\Temp\xGNdibBz.xlsm

    Filesize

    26KB

    MD5

    d13a4e3dcc4884057bb190d28d6dbfe9

    SHA1

    5475d975d1595c416705838ec6f4c58b7f628fc6

    SHA256

    e64dd00033b04179471b3ac50db661e14e9914e08337d0f89c420d69dfa66ce5

    SHA512

    6d5fab628033d8067b7d86967c55710b4482a8995360abe0b7ffb0a3cf5b15d4b30ac3786fb97f7a612d414e60aa015c32f8560c710def4fa4958044ab9efdb4

  • C:\Users\Admin\Desktop\~$OpenBackup.xlsx

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • \Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe

    Filesize

    92KB

    MD5

    2e9d3dc697a2e1fc5c5be1f7e04508dd

    SHA1

    0f72289874472de314aecefeb5457812f1c72481

    SHA256

    dbc39d1d4ddc8c744e7840a294f906920c532adc0dc9e69f7664a91b55b2ff77

    SHA512

    d938a7d94c869b3b67c70d016b10c6a3c79fc3e928f3471a829b925041feb192f2f4d77993cd450d8246e0a4eec94f2275fd44ffbb931e15a5f9e74624dc0d16

  • memory/1968-29-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1968-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2452-131-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2452-132-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2452-164-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2620-20-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2848-42-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2880-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2880-130-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB