Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 04:42
Behavioral task
behavioral1
Sample
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Resource
win10v2004-20241007-en
General
-
Target
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
-
Size
809KB
-
MD5
76778d098beed7d4e5a6efd11ce4e944
-
SHA1
4f4e8a5a6c8ba70541f291db4175c4a9d0147ad9
-
SHA256
dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c
-
SHA512
0e2fca4fc3dc13130d3915ca3a89d417ff2cc472ac5a82452963724ac24736c42543d9a2aaa801d7083bc1740d7cb9301110cd73df16436faed1f6f34bf3f85a
-
SSDEEP
12288:CMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9THaj:CnsJ39LyjbJkQFMhmC+6GD9zG
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 4984 ._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 2552 Synaptics.exe 3920 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE 4944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4984 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 84 PID 4920 wrote to memory of 4984 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 84 PID 4920 wrote to memory of 4984 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 84 PID 4920 wrote to memory of 2552 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 86 PID 4920 wrote to memory of 2552 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 86 PID 4920 wrote to memory of 2552 4920 dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe 86 PID 2552 wrote to memory of 3920 2552 Synaptics.exe 87 PID 2552 wrote to memory of 3920 2552 Synaptics.exe 87 PID 2552 wrote to memory of 3920 2552 Synaptics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"C:\Users\Admin\AppData\Local\Temp\dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"C:\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3920
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
809KB
MD576778d098beed7d4e5a6efd11ce4e944
SHA14f4e8a5a6c8ba70541f291db4175c4a9d0147ad9
SHA256dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c
SHA5120e2fca4fc3dc13130d3915ca3a89d417ff2cc472ac5a82452963724ac24736c42543d9a2aaa801d7083bc1740d7cb9301110cd73df16436faed1f6f34bf3f85a
-
C:\Users\Admin\AppData\Local\Temp\._cache_dce5dc299a658c8faa9756d2fdf2dbf977974d54c004f43ebaabc837dd22969c.exe
Filesize56KB
MD5c55940daa5bfcc9350f61f508fbbfb43
SHA1ce7b9dc8ef1de619b24a0c86c9909b3018847eac
SHA256a593b068dbd3e1ca2abbf7e2f7b55a86800bffd5a98c4f5a05f00d6e3b473d40
SHA512d9317f28812567bfae905ee8d7603b617680fd7edb1393d488b2f2e242040f316d224f45cfead3c93f762424ab2ed233a73c84a6ba96bac5687a14cf0b634269
-
Filesize
23KB
MD5efaf5eef72a754d64ab719ac657e2584
SHA1e783aee558526108c2e807848838f6487ef30087
SHA25696321fe375abf87c8754f40a962fb938d75a6610e7d67ab81d083a1f049bb609
SHA5125e587c4534752794ddc2a81684f9638214f80a14637adb26663d266567025f4aa2ec4a682611e2e65f29ac5d203b85915fbd8bf23c0296e5257d74684e46bc80
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04