Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 04:42
Behavioral task
behavioral1
Sample
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Resource
win10v2004-20241007-en
General
-
Target
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
-
Size
809KB
-
MD5
76778d098beed7d4e5a6efd11ce4e944
-
SHA1
4f4e8a5a6c8ba70541f291db4175c4a9d0147ad9
-
SHA256
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c
-
SHA512
0e2fca4fc3dc13130d3915ca3a89d417ff2cc472ac5a82452963724ac24736c42543d9a2aaa801d7083bc1740d7cb9301110cd73df16436faed1f6f34bf3f85a
-
SSDEEP
12288:CMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9THaj:CnsJ39LyjbJkQFMhmC+6GD9zG
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2908 ._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2768 Synaptics.exe 2932 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2768 Synaptics.exe 2768 Synaptics.exe 2768 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2772 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2772 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2908 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 30 PID 2744 wrote to memory of 2908 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 30 PID 2744 wrote to memory of 2908 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 30 PID 2744 wrote to memory of 2908 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 30 PID 2744 wrote to memory of 2768 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 32 PID 2744 wrote to memory of 2768 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 32 PID 2744 wrote to memory of 2768 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 32 PID 2744 wrote to memory of 2768 2744 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 32 PID 2768 wrote to memory of 2932 2768 Synaptics.exe 33 PID 2768 wrote to memory of 2932 2768 Synaptics.exe 33 PID 2768 wrote to memory of 2932 2768 Synaptics.exe 33 PID 2768 wrote to memory of 2932 2768 Synaptics.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"C:\Users\Admin\AppData\Local\Temp\dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"C:\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"2⤵
- Executes dropped EXE
PID:2908
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2932
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
809KB
MD576778d098beed7d4e5a6efd11ce4e944
SHA14f4e8a5a6c8ba70541f291db4175c4a9d0147ad9
SHA256dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c
SHA5120e2fca4fc3dc13130d3915ca3a89d417ff2cc472ac5a82452963724ac24736c42543d9a2aaa801d7083bc1740d7cb9301110cd73df16436faed1f6f34bf3f85a
-
Filesize
25KB
MD568458c4d021c97e4766bcfa54a9292e1
SHA15f1e021017b010f97c33a445daf9201af3727072
SHA2560263a5e5d48112563d17798ac247274d65cbeced46923a1406242aecea032724
SHA512cf0cf8362b361e70bac794654468ec51b53389eab406bb8303a9a991800036d82a5325c8448512f5c1e7049d12e7306b558c7c904d3fb8523cf08b85b19777c4
-
Filesize
21KB
MD51bb675da1ed98283ada76e646a226033
SHA1da491445b66b959de682b8ab2a55f107ff36774d
SHA25624869cf7fbead83c73593dda03cfabc5ffc017799ecef96e49833291a28f2f4d
SHA5126e5bd5eaf6a3c19ab12ee745ff8da970e578a09274d4a4defb5326a8cacd0bf30237fb85812558a8261e4e0c69e9d8d0b6c557ca2753fe506d236952c7aede4a
-
Filesize
27KB
MD5d29a0c15dc0490baf37613ee59cc0749
SHA17e4606bc3073049d1559783dd0de852b1371a7d3
SHA256705ea8ccfaa4d1dc6d18fd2160f137c4b5b1e54ba17786606500d12a2d21313f
SHA51274140cc578b841e4997ede516565a420f193a82a4285d321e5d79c32859565f25e554a1caffc89b9421b47d3ffa6fce30834463f752bade6ca398ef0bdad5077
-
Filesize
25KB
MD53ace55e3356da1e96f25a628487bd482
SHA1e7e32641acfe33cac8a3033fc2432006f22766d9
SHA2568ee51a5348be1fff8258c431dba85a9f16ca43c887efbc16122678bb8db81873
SHA51227a29d28a441e1b71819f746c88f5b98395ab66533ba7e25f41523b98e9ac4a4babd107670a2db784ecd7a823b76d87864a0f4cda32e726e411cd21a8a2535e1
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Filesize56KB
MD5c55940daa5bfcc9350f61f508fbbfb43
SHA1ce7b9dc8ef1de619b24a0c86c9909b3018847eac
SHA256a593b068dbd3e1ca2abbf7e2f7b55a86800bffd5a98c4f5a05f00d6e3b473d40
SHA512d9317f28812567bfae905ee8d7603b617680fd7edb1393d488b2f2e242040f316d224f45cfead3c93f762424ab2ed233a73c84a6ba96bac5687a14cf0b634269