Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2025, 09:09

General

  • Target

    93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe

  • Size

    1.1MB

  • MD5

    4c886cdaccdf919d6247ebc54caa8b29

  • SHA1

    86872c1e8c766090406ef896342e4c9d67eea077

  • SHA256

    93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3

  • SHA512

    b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345

  • SSDEEP

    12288:tMSApJVYG5lDLyjsb0eOzkv4R7Qnvt35+6G75V9FxKewO79X+27RAlJx8Eportv:tnsJ39LyjbJkQFMn+6GD93AlJx8EporJ

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
    "C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2332
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2780
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    1.1MB

    MD5

    4c886cdaccdf919d6247ebc54caa8b29

    SHA1

    86872c1e8c766090406ef896342e4c9d67eea077

    SHA256

    93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3

    SHA512

    b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    27KB

    MD5

    b71e3109b18bb688e0ac26347e32cbc0

    SHA1

    fbb5fde5c8def5f1af3ccd4c726955f5e369a5fd

    SHA256

    ad8fdf968850e6e512a83b53426d20de76a9b6741166b26db2eaca4f92802328

    SHA512

    89b554e6f1be7f476442595ebb9545cd19e374e7e2a4599b113c90c5c8b841948b0bf660d36113f9278f466fad14f0b29c3e3355fa229f2260b6c0bd38dccaa1

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    23KB

    MD5

    7ca77f5de769b38825d5094f593a4847

    SHA1

    425f0197cf0bc4f00e31d6b31a477657079db4d2

    SHA256

    78c23f2fe9db193f768cd69fe341500a11edb953e46a3ce2201e5196123b7969

    SHA512

    98905389e0d9b0cf1a24035b1046f2118daf23a24a4be238b6bc6b04f2af89ec1a0c40d72c3f8e3040e8caa3ef8b67a74d49c3f67a74da66a3a93db7b19493eb

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    24KB

    MD5

    20172db3cd30fcc40d7b1c6080506756

    SHA1

    8d9d1f2f4f825a42b67c92e202aa9573e62ca377

    SHA256

    7880acf114ee46649bba6837fbacf6341a7abda14e6ff50e58d6421ee646417c

    SHA512

    9aded587b538d566ea3187f294aa772f737fe7dd0171eaadf5c800a1fc0af8b77145e4ef345966e783a8e37438bf2ada6fbe1172596c21927549c253e7889dd8

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    25KB

    MD5

    e551e717309d5bc4595d75d95337f511

    SHA1

    2645bbb7058c4862e29860b010bca30012e4d0e9

    SHA256

    5cefd261cc23b32147187482859858db676a9c9c28b908ac615075d1460445e3

    SHA512

    9b787ad1b4dc4ca24471fa5f1c8130ddf3abee9c4e8a478ca93e4b35e1cdf53502b825fc1ffdb8ffb45104d82047d0ced824fb13950ae26fa8a06b27d7874b6b

  • C:\Users\Admin\AppData\Local\Temp\VBQtTq1H.xlsm

    Filesize

    28KB

    MD5

    929a64beec93541ab940e71d009254e3

    SHA1

    976a99dd6a360181f2bf74fe849ec4527786f210

    SHA256

    d394bd279b9967fc4ff7d9ee1f39a9e7443e95f19a70b945338b860b32348ea2

    SHA512

    bd540058e999125dcb0b69fada8ea016c246896c2aff129fc61e1c956ab4bed9e7c3187ade34d87144e46021694c2e43aee77c15b26ca181fd89c94276433c44

  • C:\Users\Admin\Desktop\~$StepInitialize.xlsx

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • \Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe

    Filesize

    333KB

    MD5

    c6377c648ac8775fcc8302c1db14a8aa

    SHA1

    2b5faa68d1c9ff2572210a6420b39e9b2d4394c9

    SHA256

    df6589654abfacb1490a9f19e9c0e32623e73f2a1b852e8a8379b7873d03a33a

    SHA512

    dfb7ea7eb049847f0ebebbd74b4fe39b464b61ca0cb161186f5a40cb8e96978f73df200ce43b0e69a8707150f2026d6171109dbd60cb498aa74465e9d96e909f

  • memory/2356-25-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2356-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2480-35-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2480-127-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2480-128-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2480-160-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/2740-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB