Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 01:58
Behavioral task
behavioral1
Sample
ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
Resource
win10v2004-20241007-en
General
-
Target
ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
-
Size
845KB
-
MD5
518b14f1482c252d13b28f50a225d68a
-
SHA1
987fb9b28922364c855700d460799e3dd701dea1
-
SHA256
ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0
-
SHA512
5e66ec6a2314a5de421d065131b0c35abda7f0b6468a81e4ebca6850dc3106e3776bb1518b804daaacd3dbf1ab1d584c1f0d1e13e069adf6f8f72116a7274e5d
-
SSDEEP
12288:RMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9cUq/TjX3DvrnAB3ITPvsA:RnsJ39LyjbJkQFMhmC+6GD9/LKNTZ
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2620 ._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 2452 Synaptics.exe 2848 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 2452 Synaptics.exe 2452 Synaptics.exe 2452 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2880 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2880 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2620 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 31 PID 1968 wrote to memory of 2620 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 31 PID 1968 wrote to memory of 2620 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 31 PID 1968 wrote to memory of 2620 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 31 PID 1968 wrote to memory of 2452 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 33 PID 1968 wrote to memory of 2452 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 33 PID 1968 wrote to memory of 2452 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 33 PID 1968 wrote to memory of 2452 1968 ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe 33 PID 2452 wrote to memory of 2848 2452 Synaptics.exe 34 PID 2452 wrote to memory of 2848 2452 Synaptics.exe 34 PID 2452 wrote to memory of 2848 2452 Synaptics.exe 34 PID 2452 wrote to memory of 2848 2452 Synaptics.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"C:\Users\Admin\AppData\Local\Temp\ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe"2⤵
- Executes dropped EXE
PID:2620
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2848
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD5518b14f1482c252d13b28f50a225d68a
SHA1987fb9b28922364c855700d460799e3dd701dea1
SHA256ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0
SHA5125e66ec6a2314a5de421d065131b0c35abda7f0b6468a81e4ebca6850dc3106e3776bb1518b804daaacd3dbf1ab1d584c1f0d1e13e069adf6f8f72116a7274e5d
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD5d9a9801796062786b8306b1a6e9c1929
SHA1adecccf44d734d7b6f8b736dc74e6323e51f67b2
SHA256cda789eb5bf0c5fa614e4fcf752c3ce93627b1db8feab029712ac3f39a33f4fa
SHA5127bd8aab60a44bb7aae1fc802ed390e2a649d0b67dfe14e06eee98d15beb4723bf7dc49896168da857f112d9b60d8b946063eb92bf296dbe9291bc7a79028095a
-
Filesize
21KB
MD52b9095428acc8a81f5a79497e3744f80
SHA1e44b56bf22c3eaf014cda2c1e35f8b7c1db13a62
SHA2560d4f2a016f70b3a754d60d098ea0c7cd8fd12127057e53db958e1872adfb3d09
SHA512f6850665b4cad5f92c2cba0f034d7b46efda471828b5d80836b1a6fdac8a61ee38bea3383993051727c531a1cb1a49a920fc2f2587da53f6b8641f4c2018e349
-
Filesize
25KB
MD58c2bffde67893aa2da6a2d0cd61b43d0
SHA185eaad3b1a54ae50473987a81076ff67606d4258
SHA25656d8a28d4cedb235a5a623a29a7beecbcd79c5b14ee9c3553956f8fd031213c7
SHA512561d5c10780de3c796a82e1a09ca82a8f379b93ecdf6cf357f9b0eff8012763d3eb8a6cc24dfc53fe94ec35a4240fab101fddf6fedbe9d31c7963c0328372fa6
-
Filesize
21KB
MD570892e61588fd9899dd78fdcbcce5ff6
SHA182a24928780dbc8c5ad55750b95ec149a424d16c
SHA2564c8361b36039814f5009cc94288f99c552f20f3bfa58a59cd6ba27415fd31a4b
SHA512ed95daeaa4cf7bf2e411b3ba34e0897758ecee4be2395b229fdbedd0d6d183f54ce46faea2a23d73d98575dd5a4b87d24bcba1494fa839fb340850d8b458ff2a
-
Filesize
26KB
MD5d13a4e3dcc4884057bb190d28d6dbfe9
SHA15475d975d1595c416705838ec6f4c58b7f628fc6
SHA256e64dd00033b04179471b3ac50db661e14e9914e08337d0f89c420d69dfa66ce5
SHA5126d5fab628033d8067b7d86967c55710b4482a8995360abe0b7ffb0a3cf5b15d4b30ac3786fb97f7a612d414e60aa015c32f8560c710def4fa4958044ab9efdb4
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
\Users\Admin\AppData\Local\Temp\._cache_ca12345c7ae085a2f0c663afc329afbfe91628593edfda5ae76784a24adf1ba0.exe
Filesize92KB
MD52e9d3dc697a2e1fc5c5be1f7e04508dd
SHA10f72289874472de314aecefeb5457812f1c72481
SHA256dbc39d1d4ddc8c744e7840a294f906920c532adc0dc9e69f7664a91b55b2ff77
SHA512d938a7d94c869b3b67c70d016b10c6a3c79fc3e928f3471a829b925041feb192f2f4d77993cd450d8246e0a4eec94f2275fd44ffbb931e15a5f9e74624dc0d16