Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 00:45
Behavioral task
behavioral1
Sample
8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe
Resource
win10v2004-20241007-en
General
-
Target
8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe
-
Size
2.2MB
-
MD5
00c3dea667e2b04fa4c07b534137f6f5
-
SHA1
ef4df9e0ffd5d10b70e18ed2fc29bb30f51bc4e2
-
SHA256
8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70
-
SHA512
57b5243193b1349df7d8eb6b1c70ede8430295fb90955ac61cbb8aef87be1efdf4ce761bdd331cced7f5f8f8a794f282f866d0a784b94ee30dffcdd5bd853d5d
-
SSDEEP
24576:rnsJ39LyjbJkQFMhmC+6GD9mmXKSLhy9lEi4cXndp0KMzcpxXLpQ6RaILIMDd:rnsHyjtk2MYC5GDnFy9bHQnmd
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 620 ._cache_8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 2540 Synaptics.exe 5052 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4840 620 WerFault.exe 83 3880 5052 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3732 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE 3732 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 116 wrote to memory of 620 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 83 PID 116 wrote to memory of 620 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 83 PID 116 wrote to memory of 620 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 83 PID 116 wrote to memory of 2540 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 84 PID 116 wrote to memory of 2540 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 84 PID 116 wrote to memory of 2540 116 8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe 84 PID 2540 wrote to memory of 5052 2540 Synaptics.exe 88 PID 2540 wrote to memory of 5052 2540 Synaptics.exe 88 PID 2540 wrote to memory of 5052 2540 Synaptics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe"C:\Users\Admin\AppData\Local\Temp\8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\._cache_8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 8243⤵
- Program crash
PID:4840
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 8244⤵
- Program crash
PID:3880
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 620 -ip 6201⤵PID:4764
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5052 -ip 50521⤵PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD500c3dea667e2b04fa4c07b534137f6f5
SHA1ef4df9e0ffd5d10b70e18ed2fc29bb30f51bc4e2
SHA2568d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70
SHA51257b5243193b1349df7d8eb6b1c70ede8430295fb90955ac61cbb8aef87be1efdf4ce761bdd331cced7f5f8f8a794f282f866d0a784b94ee30dffcdd5bd853d5d
-
C:\Users\Admin\AppData\Local\Temp\._cache_8d45db15e5ce613af3ec3e49dd1733ffa4e0d082a9a7be70b601891ee302ec70.exe
Filesize1.4MB
MD52555774cd1c4c5647221b87cc2cf0df2
SHA1238425ea7b788df6def4c28d617d2c32ae9e4e57
SHA256c8ee018d958ebad1f42053ffe38ab1763ebb115bde00e340297fcdfac9967376
SHA5122069e78a4478285b2440bd96e8788503a4948c4c63ffa005f093f7f242dae1a40cf67bd559cce89c3396537af267eedebcd0dc81f0c9c04e0da875fdc2e36321
-
Filesize
21KB
MD5bb76c6e824f903016a19de52252b09b9
SHA1d313dbcf365f3c15cf4ddd683fed20e1387ad69e
SHA2567404459544aab88ca89f53000d538177127cc18cd47d8f16509deef10022d698
SHA512b2739b3b911afa4938622ead7e40036b420a24e0d3ef4be8c9c0f483ecf578ecb42bd978158512b376078f3afdb6a3eaf3d75c92b7ddca31d0cffc1b05fbbc16
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04