Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 09:09
Behavioral task
behavioral1
Sample
93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Resource
win10v2004-20241007-en
General
-
Target
93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
-
Size
1.1MB
-
MD5
4c886cdaccdf919d6247ebc54caa8b29
-
SHA1
86872c1e8c766090406ef896342e4c9d67eea077
-
SHA256
93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3
-
SHA512
b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345
-
SSDEEP
12288:tMSApJVYG5lDLyjsb0eOzkv4R7Qnvt35+6G75V9FxKewO79X+27RAlJx8Eportv:tnsJ39LyjbJkQFMn+6GD93AlJx8EporJ
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x000600000001a061-108.dat -
Executes dropped EXE 3 IoCs
pid Process 2332 ._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 2480 Synaptics.exe 2780 ._cache_Synaptics.exe -
Loads dropped DLL 5 IoCs
pid Process 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 2480 Synaptics.exe 2480 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2740 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2332 ._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2740 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2332 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 30 PID 2356 wrote to memory of 2332 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 30 PID 2356 wrote to memory of 2332 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 30 PID 2356 wrote to memory of 2332 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 30 PID 2356 wrote to memory of 2480 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 31 PID 2356 wrote to memory of 2480 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 31 PID 2356 wrote to memory of 2480 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 31 PID 2356 wrote to memory of 2480 2356 93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe 31 PID 2480 wrote to memory of 2780 2480 Synaptics.exe 32 PID 2480 wrote to memory of 2780 2480 Synaptics.exe 32 PID 2480 wrote to memory of 2780 2480 Synaptics.exe 32 PID 2480 wrote to memory of 2780 2480 Synaptics.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"C:\Users\Admin\AppData\Local\Temp\93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"C:\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2332
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54c886cdaccdf919d6247ebc54caa8b29
SHA186872c1e8c766090406ef896342e4c9d67eea077
SHA25693ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3
SHA512b7f8937bdecf21e3d928febc4ad446c7adc416fc209a2e9f3c8dd88fcfe6bc2dbb10a9b51c5d9e9d181be398fbd4f47c09d40a5873f565020fb6fdb92b1b7345
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
27KB
MD5b71e3109b18bb688e0ac26347e32cbc0
SHA1fbb5fde5c8def5f1af3ccd4c726955f5e369a5fd
SHA256ad8fdf968850e6e512a83b53426d20de76a9b6741166b26db2eaca4f92802328
SHA51289b554e6f1be7f476442595ebb9545cd19e374e7e2a4599b113c90c5c8b841948b0bf660d36113f9278f466fad14f0b29c3e3355fa229f2260b6c0bd38dccaa1
-
Filesize
23KB
MD57ca77f5de769b38825d5094f593a4847
SHA1425f0197cf0bc4f00e31d6b31a477657079db4d2
SHA25678c23f2fe9db193f768cd69fe341500a11edb953e46a3ce2201e5196123b7969
SHA51298905389e0d9b0cf1a24035b1046f2118daf23a24a4be238b6bc6b04f2af89ec1a0c40d72c3f8e3040e8caa3ef8b67a74d49c3f67a74da66a3a93db7b19493eb
-
Filesize
24KB
MD520172db3cd30fcc40d7b1c6080506756
SHA18d9d1f2f4f825a42b67c92e202aa9573e62ca377
SHA2567880acf114ee46649bba6837fbacf6341a7abda14e6ff50e58d6421ee646417c
SHA5129aded587b538d566ea3187f294aa772f737fe7dd0171eaadf5c800a1fc0af8b77145e4ef345966e783a8e37438bf2ada6fbe1172596c21927549c253e7889dd8
-
Filesize
25KB
MD5e551e717309d5bc4595d75d95337f511
SHA12645bbb7058c4862e29860b010bca30012e4d0e9
SHA2565cefd261cc23b32147187482859858db676a9c9c28b908ac615075d1460445e3
SHA5129b787ad1b4dc4ca24471fa5f1c8130ddf3abee9c4e8a478ca93e4b35e1cdf53502b825fc1ffdb8ffb45104d82047d0ced824fb13950ae26fa8a06b27d7874b6b
-
Filesize
28KB
MD5929a64beec93541ab940e71d009254e3
SHA1976a99dd6a360181f2bf74fe849ec4527786f210
SHA256d394bd279b9967fc4ff7d9ee1f39a9e7443e95f19a70b945338b860b32348ea2
SHA512bd540058e999125dcb0b69fada8ea016c246896c2aff129fc61e1c956ab4bed9e7c3187ade34d87144e46021694c2e43aee77c15b26ca181fd89c94276433c44
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
\Users\Admin\AppData\Local\Temp\._cache_93ec94e2b7ee6b1d6fdeabd15b84a3a89bd75fb4f9fc88cbc2b495b30d6cf6b3.exe
Filesize333KB
MD5c6377c648ac8775fcc8302c1db14a8aa
SHA12b5faa68d1c9ff2572210a6420b39e9b2d4394c9
SHA256df6589654abfacb1490a9f19e9c0e32623e73f2a1b852e8a8379b7873d03a33a
SHA512dfb7ea7eb049847f0ebebbd74b4fe39b464b61ca0cb161186f5a40cb8e96978f73df200ce43b0e69a8707150f2026d6171109dbd60cb498aa74465e9d96e909f