Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 09:07
Behavioral task
behavioral1
Sample
8.0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8.0.exe
Resource
win10v2004-20241007-en
General
-
Target
8.0.exe
-
Size
1.0MB
-
MD5
7bfcd8f6d2396fac92e1693cbc15fc0d
-
SHA1
b60b4aa3be6ca2bb357d7e921685dffc88bf6196
-
SHA256
922f57f2041b3e1e0a5ef916bed236a658332ced17091d551d1580c0fae62629
-
SHA512
fbf4ae62c34c475f9d090e2003d3b492347c9a6023898f24f2d7dce7943eefebb463bc816c4c7edc1a66b8d547983e799db42c241635745c4a2285ee6b7d9526
-
SSDEEP
24576:ensJ39LyjbJkQFMhmC+6GD9d2Aup39eCLjVg:ensHyjtk2MYC5GDuAoDS
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/memory/2900-196-0x0000000000400000-0x00000000004EC000-memory.dmp family_blackmoon behavioral2/memory/3780-197-0x0000000000400000-0x00000000004EC000-memory.dmp family_blackmoon behavioral2/memory/3780-202-0x0000000000400000-0x00000000004EC000-memory.dmp family_blackmoon -
Xred family
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\._cache_8.0.exe ._cache_8.0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_8.0.EXE ._cache_8.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\._cache_Synaptics.exe ._cache_Synaptics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_SYNAPTICS.EXE ._cache_Synaptics.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 8.0.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3780 ._cache_8.0.exe 4552 Synaptics.exe 2900 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 8.0.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_8.0.EXE ._cache_8.0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_SYNAPTICS.EXE ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_8.0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies Control Panel 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\LanguageConfiguration ._cache_Synaptics.exe Key deleted \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop ._cache_8.0.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\LanguageConfiguration ._cache_8.0.exe Key deleted \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION ._cache_8.0.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 624 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3780 ._cache_8.0.exe Token: SeBackupPrivilege 3780 ._cache_8.0.exe Token: SeRestorePrivilege 3780 ._cache_8.0.exe Token: SeDebugPrivilege 2900 ._cache_Synaptics.exe Token: SeBackupPrivilege 2900 ._cache_Synaptics.exe Token: SeRestorePrivilege 2900 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE 624 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3780 3176 8.0.exe 83 PID 3176 wrote to memory of 3780 3176 8.0.exe 83 PID 3176 wrote to memory of 3780 3176 8.0.exe 83 PID 3176 wrote to memory of 4552 3176 8.0.exe 84 PID 3176 wrote to memory of 4552 3176 8.0.exe 84 PID 3176 wrote to memory of 4552 3176 8.0.exe 84 PID 4552 wrote to memory of 2900 4552 Synaptics.exe 85 PID 4552 wrote to memory of 2900 4552 Synaptics.exe 85 PID 4552 wrote to memory of 2900 4552 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8.0.exe"C:\Users\Admin\AppData\Local\Temp\8.0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\._cache_8.0.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8.0.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:624
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD57bfcd8f6d2396fac92e1693cbc15fc0d
SHA1b60b4aa3be6ca2bb357d7e921685dffc88bf6196
SHA256922f57f2041b3e1e0a5ef916bed236a658332ced17091d551d1580c0fae62629
SHA512fbf4ae62c34c475f9d090e2003d3b492347c9a6023898f24f2d7dce7943eefebb463bc816c4c7edc1a66b8d547983e799db42c241635745c4a2285ee6b7d9526
-
Filesize
274KB
MD5306c6ba344dce0d0f15383ca86885e26
SHA1b89f1a4aae322a4d0b4b4bf331f85dddf8b2f4c7
SHA2565a68374be6d87cb5f975dbefb7401e3d74f10f73e329d1c6aa747da3ea77d410
SHA512d2b6c353c7ae17094acab5afb8cac8d0495482d997212133a1a304c235e009aa908203f322d56c27ba9929b9ceb6f52f373828963293e6f5dd7396a21a0c1da0
-
Filesize
21KB
MD5b9cb2547bde5885b9227386f3397ee6f
SHA10c9764f28b9abe7e3103ea9b03694f8250cd72cb
SHA256b9365bd3b5a918355e87d3e86f02510f9f28146ee4fccf1a1845e25e2d6c6970
SHA5126bdb23778f6f38ccd185a8afca0a6d841bf19eb788744ac626a71ae64f6d08b4d25e8db18767032650df4382cfa53885e06966ce8073a43b0ac6a97cda23460f
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04