Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648.msi
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648.msi
-
Size
1.7MB
-
MD5
904ac94be4b6b3e1a4bf741d80401879
-
SHA1
bfd7f9e4bb42f54c02c4933439c9e90b8c975299
-
SHA256
fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648
-
SHA512
c2ff2e02c00e485e3551c6a8b3451cf227f8317e4b908b4fe1202337288937cebffbdbd2f5bc5ae33326ef9e14e9f8c18563bdfe3d6d5c9dad7413b96fbd31e9
-
SSDEEP
49152:PEVnsHyjtk2MYC5GDFhloJfjQiCSAKyHI9K9:mnsmtk2aAhl0RC1g
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIE14C.tmp -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_MSIE14C.tmp MSIE14C.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIE14C.tmp MSIE14C.tmp -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76e044.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE14C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE11C.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76e044.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76e041.msi msiexec.exe File opened for modification C:\Windows\Installer\f76e041.msi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2640 MSIE14C.tmp 2656 Synaptics.exe -
Loads dropped DLL 2 IoCs
pid Process 2640 MSIE14C.tmp 2640 MSIE14C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2148 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIE14C.tmp -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3012 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2268 msiexec.exe 2268 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2148 msiexec.exe Token: SeIncreaseQuotaPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeCreateTokenPrivilege 2148 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2148 msiexec.exe Token: SeLockMemoryPrivilege 2148 msiexec.exe Token: SeIncreaseQuotaPrivilege 2148 msiexec.exe Token: SeMachineAccountPrivilege 2148 msiexec.exe Token: SeTcbPrivilege 2148 msiexec.exe Token: SeSecurityPrivilege 2148 msiexec.exe Token: SeTakeOwnershipPrivilege 2148 msiexec.exe Token: SeLoadDriverPrivilege 2148 msiexec.exe Token: SeSystemProfilePrivilege 2148 msiexec.exe Token: SeSystemtimePrivilege 2148 msiexec.exe Token: SeProfSingleProcessPrivilege 2148 msiexec.exe Token: SeIncBasePriorityPrivilege 2148 msiexec.exe Token: SeCreatePagefilePrivilege 2148 msiexec.exe Token: SeCreatePermanentPrivilege 2148 msiexec.exe Token: SeBackupPrivilege 2148 msiexec.exe Token: SeRestorePrivilege 2148 msiexec.exe Token: SeShutdownPrivilege 2148 msiexec.exe Token: SeDebugPrivilege 2148 msiexec.exe Token: SeAuditPrivilege 2148 msiexec.exe Token: SeSystemEnvironmentPrivilege 2148 msiexec.exe Token: SeChangeNotifyPrivilege 2148 msiexec.exe Token: SeRemoteShutdownPrivilege 2148 msiexec.exe Token: SeUndockPrivilege 2148 msiexec.exe Token: SeSyncAgentPrivilege 2148 msiexec.exe Token: SeEnableDelegationPrivilege 2148 msiexec.exe Token: SeManageVolumePrivilege 2148 msiexec.exe Token: SeImpersonatePrivilege 2148 msiexec.exe Token: SeCreateGlobalPrivilege 2148 msiexec.exe Token: SeBackupPrivilege 2096 vssvc.exe Token: SeRestorePrivilege 2096 vssvc.exe Token: SeAuditPrivilege 2096 vssvc.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeLoadDriverPrivilege 2604 DrvInst.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2148 msiexec.exe 2148 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3012 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2640 2268 msiexec.exe 35 PID 2268 wrote to memory of 2640 2268 msiexec.exe 35 PID 2268 wrote to memory of 2640 2268 msiexec.exe 35 PID 2268 wrote to memory of 2640 2268 msiexec.exe 35 PID 2640 wrote to memory of 2656 2640 MSIE14C.tmp 36 PID 2640 wrote to memory of 2656 2640 MSIE14C.tmp 36 PID 2640 wrote to memory of 2656 2640 MSIE14C.tmp 36 PID 2640 wrote to memory of 2656 2640 MSIE14C.tmp 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fbbbf890b135445dec6c10625b0fdad8246523ba83e6e052a74e01d3856fb648.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2148
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\Installer\MSIE14C.tmp"C:\Windows\Installer\MSIE14C.tmp"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003C4" "00000000000003BC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
681B
MD585131c3873479f255837e32609a0d3c5
SHA16e24a3493171412d4234d4c9c1ff6c35efd6eb23
SHA2566f9521c693a36dc0d449f09d92bc2307e261e8e58e832cbda15bc240707fb2ec
SHA5124c6e1358c503bd04de161e2b451dbd08f859740473b62e303c241ad8bb8994c56b63b26aa80a03951cbff11818da196eab572abfa276fb828f075ac03cbc150b
-
Filesize
753KB
MD54bc81d74086b89c85f1d208f781675f3
SHA1c5245605e8ca888e36810a817dc977696207b90b
SHA256f85a3eaa91c625fda14fe0c55bed7c3f43321475d871aa07af90a2e532219b85
SHA5123fd588e5a49cca2c63784ae363ff5fae6574d83f08d877f1089768e000f0a7dafd51b7b28c2a543426073f2d9a96fc1e1e25796c713a5141e97c7e283901a750
-
Filesize
24KB
MD529814b1a54acb6bdc5765fda5477ea14
SHA1dfbffb3d7a2193d821bb4ef1cbfb9407b0e97412
SHA256e7e1e151128809c081430750da3aca43ed25c7bc2d9be830f371660c9bcf2aa3
SHA512c1cf4c5d4d1094cdb6991e5ba26f873d8b128eaed07a7d5054739e86a7e4aea3ca32b248765c93c6981fc2887b10793b8abafd7f6acb2fde5b9244091fbefa87
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1.6MB
MD5a0177c0a9f2254179b112eecf3c58cc6
SHA103478f572f818c8ffd7f8ebe23632432e82e4461
SHA25655d2bea108eeaabcdf59d449cf15f0efabb59e243d9bd91ff0b0805cd3d133df
SHA5120247f803d5018659899766fe8758c14081b1fe9f414c2afb8f34e78569bf5e9063b746c3adf388b60017367070582e7d8b9422ae94bcef4c8c0d39fa7e4a4470