Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 21:38
Behavioral task
behavioral1
Sample
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Resource
win10v2004-20241007-en
General
-
Target
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
-
Size
1011KB
-
MD5
6fdfd2a6d0b7c47759b00d7dd25e5940
-
SHA1
596de87c84b76dc067f41857ac4e54dffb23a4fc
-
SHA256
caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489d
-
SHA512
cc5cd25fdf4f4a109b10cf09ca6bd8e23916a4cba4c6103afce355ccc25f5b49f8a4a7b03f77abc5302f697552501651911f174c6d4892820c4d1225a9d36ae5
-
SSDEEP
24576:KnsJ39LyjbJkQFMhmC+6GD9ATuoIK4PVXWr:KnsHyjtk2MYC5GDyTuo2Pd4
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 2780 ._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 2364 Synaptics.exe 2644 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 944 EXCEL.EXE 944 EXCEL.EXE 944 EXCEL.EXE 944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 552 wrote to memory of 2780 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 82 PID 552 wrote to memory of 2780 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 82 PID 552 wrote to memory of 2780 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 82 PID 552 wrote to memory of 2364 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 84 PID 552 wrote to memory of 2364 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 84 PID 552 wrote to memory of 2364 552 caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe 84 PID 2364 wrote to memory of 2644 2364 Synaptics.exe 85 PID 2364 wrote to memory of 2644 2364 Synaptics.exe 85 PID 2364 wrote to memory of 2644 2364 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"C:\Users\Admin\AppData\Local\Temp\caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"C:\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1011KB
MD56fdfd2a6d0b7c47759b00d7dd25e5940
SHA1596de87c84b76dc067f41857ac4e54dffb23a4fc
SHA256caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489d
SHA512cc5cd25fdf4f4a109b10cf09ca6bd8e23916a4cba4c6103afce355ccc25f5b49f8a4a7b03f77abc5302f697552501651911f174c6d4892820c4d1225a9d36ae5
-
C:\Users\Admin\AppData\Local\Temp\._cache_caf3cc1c0e46b403569d48f1d0755e4adb2e5c8d83e44699729476f3aa97489dN.exe
Filesize258KB
MD5911218ad9b6d8a0d54a14711d3bf464f
SHA1f72de5880ae3ed30eabd8618c5ca3106df3cbdcc
SHA256bf9256c1c62f6e7733479cd60c9c8ef24d41ce32a59f2840d77e971b24edd6dd
SHA5129a1e2c2d07adc0b0945e2542d43de256fc6791559d28bacd4684087a60b466fe730852459f0f04bdde187523568cac002334df3fb05a84e9175344ccbb288874
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da