Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2025, 22:33
Behavioral task
behavioral1
Sample
FileGrab.exe
Resource
win10v2004-20241007-en
General
-
Target
FileGrab.exe
-
Size
802KB
-
MD5
f4d902e70524666a52182720fe208ab1
-
SHA1
33774655d0fc10bccd652e95b18fb428dcd80a38
-
SHA256
6eb643eb56e8fbff11276d23354b6b473bc252464d3ef7b98ec8cbbd57792f8e
-
SHA512
5bf37506097654f384f12f2d90fc9888f0bb5eaa548033a616ed16cbc90fd7a6483aa1b74f7423925e11f7f826e42d5373ac1c88ab7b049e63e23288ac656d65
-
SSDEEP
12288:2MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V935lC6FOj:2nsJ39LyjbJkQFMhmC+6GD9q6Fq
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation FileGrab.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 2096 ._cache_FileGrab.exe 2988 Synaptics.exe 1456 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" FileGrab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileGrab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_FileGrab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ FileGrab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 392 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1456 ._cache_Synaptics.exe 2096 ._cache_FileGrab.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 392 EXCEL.EXE 392 EXCEL.EXE 392 EXCEL.EXE 392 EXCEL.EXE 392 EXCEL.EXE 392 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4108 wrote to memory of 2096 4108 FileGrab.exe 84 PID 4108 wrote to memory of 2096 4108 FileGrab.exe 84 PID 4108 wrote to memory of 2096 4108 FileGrab.exe 84 PID 4108 wrote to memory of 2988 4108 FileGrab.exe 85 PID 4108 wrote to memory of 2988 4108 FileGrab.exe 85 PID 4108 wrote to memory of 2988 4108 FileGrab.exe 85 PID 2988 wrote to memory of 1456 2988 Synaptics.exe 86 PID 2988 wrote to memory of 1456 2988 Synaptics.exe 86 PID 2988 wrote to memory of 1456 2988 Synaptics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\FileGrab.exe"C:\Users\Admin\AppData\Local\Temp\FileGrab.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\._cache_FileGrab.exe"C:\Users\Admin\AppData\Local\Temp\._cache_FileGrab.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2096
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1456
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
802KB
MD5f4d902e70524666a52182720fe208ab1
SHA133774655d0fc10bccd652e95b18fb428dcd80a38
SHA2566eb643eb56e8fbff11276d23354b6b473bc252464d3ef7b98ec8cbbd57792f8e
SHA5125bf37506097654f384f12f2d90fc9888f0bb5eaa548033a616ed16cbc90fd7a6483aa1b74f7423925e11f7f826e42d5373ac1c88ab7b049e63e23288ac656d65
-
Filesize
49KB
MD527f87ebebb071afec1891e00fd0700a4
SHA1fbfc0a10ecf83da88df02356568bcac2399b3b9d
SHA25611b8cdd387370de1d162516b82376ecf28d321dc8f46ebcce389dccc2a5a4cc9
SHA5125386cae4eef9b767082d1143962851727479295b75321e07927bf7ebd60c5e051aeb78d6fa306ed6ef1c1d0182a16f1132a23263aefe9ed5d9d446b70b43a25d
-
Filesize
24KB
MD5084773f2bc4705af8968c30eeb66a38d
SHA11b2cafefdbb13de9aa3a5452ba795efd90cb8339
SHA25629f43c893b99343807577f0156be29fa712b4254711dd56cfc2f6c25e7fc8f3b
SHA512a9b4c46cffd9a62b69902ac114679c88550e9eb6689c8e11b465901b735fc9e7f26e809524ebcafb1ae5ea6d26d222d6c5ff58a1fd16e75ef6b189589ddbfc83
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04