Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 13:14
Behavioral task
behavioral1
Sample
42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe
Resource
win10v2004-20241007-en
General
-
Target
42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe
-
Size
1021KB
-
MD5
3bc4e56d5ddc58df48bbc4ba451af67c
-
SHA1
21eb375c2dff178d2fc6a6202f6762548b8c06b2
-
SHA256
42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee
-
SHA512
5ea415188e1f70167df7f82fb0b0c97a3d0e8d4e62231865687aff023afe0779fbf8d9c51fe6c51193de2101061b32b4e5a7cf0b4d325fdad9cbd9b86653451a
-
SSDEEP
24576:KnsJ39LyjbJkQFMhmC+6GD9aafVqSrh3k/B:KnsHyjtk2MYC5GDkafVqSrh3k/B
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Executes dropped EXE 3 IoCs
pid Process 2200 ._cache_42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 2288 Synaptics.exe 2324 ._cache_Synaptics.exe -
Loads dropped DLL 7 IoCs
pid Process 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 2288 Synaptics.exe 2288 Synaptics.exe 2288 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2144 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2144 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2200 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 28 PID 2848 wrote to memory of 2200 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 28 PID 2848 wrote to memory of 2200 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 28 PID 2848 wrote to memory of 2200 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 28 PID 2848 wrote to memory of 2288 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 29 PID 2848 wrote to memory of 2288 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 29 PID 2848 wrote to memory of 2288 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 29 PID 2848 wrote to memory of 2288 2848 42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe 29 PID 2288 wrote to memory of 2324 2288 Synaptics.exe 30 PID 2288 wrote to memory of 2324 2288 Synaptics.exe 30 PID 2288 wrote to memory of 2324 2288 Synaptics.exe 30 PID 2288 wrote to memory of 2324 2288 Synaptics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe"C:\Users\Admin\AppData\Local\Temp\42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\._cache_42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe"C:\Users\Admin\AppData\Local\Temp\._cache_42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe"2⤵
- Executes dropped EXE
PID:2200
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
PID:2324
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1021KB
MD53bc4e56d5ddc58df48bbc4ba451af67c
SHA121eb375c2dff178d2fc6a6202f6762548b8c06b2
SHA25642471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee
SHA5125ea415188e1f70167df7f82fb0b0c97a3d0e8d4e62231865687aff023afe0779fbf8d9c51fe6c51193de2101061b32b4e5a7cf0b4d325fdad9cbd9b86653451a
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
\Users\Admin\AppData\Local\Temp\._cache_42471e35117f1dc9a15f333a11522be7cd9d91255f60e236ead34a52d72184ee.exe
Filesize268KB
MD555724bf61eefd13611789e5f0f387a8a
SHA1b661287177658c25a392cd9dd749cbcd2c90ae37
SHA256235b06c8f26af530286446dd9ff2808eefb8db07631bf35ee958e5e351bfd10a
SHA512f37cccdf865d5a75f4807cd3eeaa117064bc51c8341bc04fbb525b7761e389e0cd38c7cd4f066fd9e6b09fc169e855636e268bdc5f090f4fd0cd4c382c8f7adb