Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:27

General

  • Target

    5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi

  • Size

    1.7MB

  • MD5

    51dd5767de678bb6359cbb175319f0ec

  • SHA1

    76ae487dda6cf3651a9b2b30614c0fefd1f3149c

  • SHA256

    5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314

  • SHA512

    ffb798290e2f6840eb8f0587dc675e8654589bfd070b1c54e49c7984272aa94da3a493cbd28b1dddef1f6a44b09ad9fd8a14ec0d77b90f948dc85089f91cc8a0

  • SSDEEP

    49152:+EJnsHyjtk2MYC5GDChloJfWJ255hpB14Rd:1nsmtk2arhlTJ23h

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 5 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2116
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\Installer\MSIDDC4.tmp
      "C:\Windows\Installer\MSIDDC4.tmp"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\SysWOW64\._cache_Synaptics.exe
          "C:\Windows\system32\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Drops startup file
          • Adds Run key to start application
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:1168
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2220
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 1
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1872
          • C:\Windows\SysWOW64\WSCript.exe
            WSCript C:\Users\Admin\AppData\Local\Temp\MRIYKG.vbs
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2120
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2096
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003BC" "00000000000003C4"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2440
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {D0B294AB-25E5-4F51-A3DA-6F60C764AE51} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe
      C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1272
    • C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe
      C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76dcbc.rbs

    Filesize

    681B

    MD5

    d42d56679c5c92d3fd0232cf2d42a6ab

    SHA1

    867819e2f60dbf9334af1b0004a31e4647e91dd6

    SHA256

    7bc647f3e292f9aa7c25caa7ffae8d02d36efe66a1e79e76ab8bea0e71f31a23

    SHA512

    cc64f2fe22edc4e56f0f8df8335284eecd808745d1dde2c46a8f8be13d1277ad904f625fde7d7fa7debd753db8e09502f2377147fcd6c98c85767ba60112dfa1

  • C:\Users\Admin\AppData\Local\Temp\Ex9utLHW.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\Ex9utLHW.xlsm

    Filesize

    24KB

    MD5

    e2da73884428567bdc49edac0aaa5abd

    SHA1

    394c2858e2734b2158b6d90552a13dfb52a1f31c

    SHA256

    670eb480f480afa7481988b4a430869b878db9ffdc0e162f5bd69a464e6db6e1

    SHA512

    bc907b410b840ed9a232a240bc3e37e0eee08756644ea420e42f6cbb497a8a1e99bc5dee30ab58ae71abaf88eb726dddfd12cb2bd8ea349c85ba8c96dab73d91

  • C:\Users\Admin\AppData\Local\Temp\MRIYKG.vbs

    Filesize

    840B

    MD5

    89137407cd4107effa2ff9f29a2a99ad

    SHA1

    99814ebc80118160841a2cf0f29eb578b57e4ac6

    SHA256

    cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36

    SHA512

    d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b

  • C:\Windows\Installer\MSIDDC4.tmp

    Filesize

    1.6MB

    MD5

    1d2237faf8e6198625010cb580280901

    SHA1

    592449bddf763bb63c22f638cb42f71484f87f06

    SHA256

    78643b903379276085c5ef0092afc5c10dee821c5754e01bc8ef835907b16ac4

    SHA512

    8abe1ff967d92c663080caf54f315e534ea296c91474d66cd327dccc38a3aa8685101649bb120e28f1438011596dde4f2f83e8150c90d51529efce9906a5aa0b

  • C:\Windows\SysWOW64\._cache_Synaptics.exe

    Filesize

    935KB

    MD5

    a1d37a2a0a4cd5038e129946ee935868

    SHA1

    87042fbecf1558a2e974c6ad045584f23e1ac7c9

    SHA256

    9988b0297ad8be4bd3c559437176eaca54cdc36593728967395c4dee21fc898c

    SHA512

    eb6cfcc7b1c526c06737dc6187af4f65bdd178ffc951cf8bb13571b44cc2c3c0cd051c6e9b4930433f8e6830420a04e0b538d353dd86a1fefb0663032c37c03c

  • memory/1168-112-0x00000000007E0000-0x00000000007F0000-memory.dmp

    Filesize

    64KB

  • memory/1168-116-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-181-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-172-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-54-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-166-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-109-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-118-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1168-62-0x00000000007E0000-0x00000000007F0000-memory.dmp

    Filesize

    64KB

  • memory/1168-111-0x0000000000070000-0x0000000000274000-memory.dmp

    Filesize

    2.0MB

  • memory/1264-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1272-133-0x0000000001270000-0x0000000001474000-memory.dmp

    Filesize

    2.0MB

  • memory/1272-134-0x0000000001270000-0x0000000001474000-memory.dmp

    Filesize

    2.0MB

  • memory/1676-176-0x00000000003A0000-0x00000000005A4000-memory.dmp

    Filesize

    2.0MB

  • memory/1676-177-0x00000000003A0000-0x00000000005A4000-memory.dmp

    Filesize

    2.0MB

  • memory/1920-113-0x0000000000400000-0x00000000005AC000-memory.dmp

    Filesize

    1.7MB

  • memory/1920-110-0x0000000000400000-0x00000000005AC000-memory.dmp

    Filesize

    1.7MB

  • memory/1920-165-0x0000000000400000-0x00000000005AC000-memory.dmp

    Filesize

    1.7MB

  • memory/1920-108-0x0000000005AC0000-0x0000000005CC4000-memory.dmp

    Filesize

    2.0MB

  • memory/1920-53-0x0000000005AC0000-0x0000000005CC4000-memory.dmp

    Filesize

    2.0MB

  • memory/2648-33-0x0000000000400000-0x00000000005AC000-memory.dmp

    Filesize

    1.7MB