Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/01/2025, 20:51

250131-zngnysynhl 10

22/01/2025, 17:19

250122-vv8c2awqf1 10

22/01/2025, 16:20

250122-ts986swjel 10

22/01/2025, 13:44

250122-q2a9nayng1 10

22/01/2025, 13:43

250122-q1jjmszmel 10

22/01/2025, 13:42

250122-qz519ayncz 10

21/01/2025, 02:07

250121-cjzbwa1jhp 10

20/01/2025, 18:36

250120-w88fmasqfy 10

20/01/2025, 18:27

250120-w3q96asnh1 10

Analysis

  • max time kernel
    41s
  • max time network
    46s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/01/2025, 13:43

General

  • Target

    4363463463464363463463463.exe

  • Size

    764KB

  • MD5

    85e3d4ac5a6ef32fb93764c090ef32b7

  • SHA1

    adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52

  • SHA256

    4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

  • SHA512

    a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab

  • SSDEEP

    12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

Version

5.0

C2

event-dollar.gl.at.ply.gg:42627

Mutex

Vu8KDOzYd19RAWuh

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Desktop Window Manager.exe

  • telegram

    https://api.telegram.org/bot7269786725:AAF0IPx1BWTdW_vbZqP8HGNrxWWFpF5CvYs/sendMessage?chat_id=5465523859

aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

217.195.195.46:1604

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Detect Xworm Payload 2 IoCs
  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Async RAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Users\Admin\AppData\Local\Temp\Files\w.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\w.exe"
        3⤵
        • Executes dropped EXE
        PID:3804
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Desktop Window Manager.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Desktop Window Manager.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3620
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Desktop Window Manager" /tr "C:\ProgramData\Desktop Window Manager.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:776
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    764KB

    MD5

    85e3d4ac5a6ef32fb93764c090ef32b7

    SHA1

    adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52

    SHA256

    4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

    SHA512

    a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    627073ee3ca9676911bee35548eff2b8

    SHA1

    4c4b68c65e2cab9864b51167d710aa29ebdcff2e

    SHA256

    85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

    SHA512

    3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    05b3cd21c1ec02f04caba773186ee8d0

    SHA1

    39e790bfe10abf55b74dfb3603df8fcf6b5e6edb

    SHA256

    911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8

    SHA512

    e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    df808b11175970c23f00e611a7b6d2cc

    SHA1

    0243f099e483fcafb6838c0055982e65634b6db6

    SHA256

    2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

    SHA512

    c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    944B

    MD5

    781da0576417bf414dc558e5a315e2be

    SHA1

    215451c1e370be595f1c389f587efeaa93108b4c

    SHA256

    41a5aef8b0bbeea2766f40a7bba2c78322379f167c610f7055ccb69e7db030fe

    SHA512

    24e283aa30a2903ebe154dad49b26067a45e46fec57549ad080d3b9ec3f272044efaaed3822d067837f5521262192f466c47195ffe7f75f8c7c5dcf3159ea737

  • C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe

    Filesize

    10KB

    MD5

    2a94f3960c58c6e70826495f76d00b85

    SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

    SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

    SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe

    Filesize

    39KB

    MD5

    93db28cf0c7dbc678c854f712719b16f

    SHA1

    434b3ac4527963101e720e2555570b95307da692

    SHA256

    b94b67c16df12216176e48ac4ad3b101cf087e0d2c2e4599b9439c41a0d0889e

    SHA512

    fecbfe7cd590f15d862a16d70c8712cb93a72e1bb9b8155577114b95ffca895876cc8013eeb2e90e130c86b1168f277aa28f275a21aca36c81650ca96afa1182

  • C:\Users\Admin\AppData\Local\Temp\Files\w.exe

    Filesize

    47KB

    MD5

    d4826d365cf4dd98966196f868817394

    SHA1

    2d17bf67b0a179b2f32a3f6e57c960a9eae42be5

    SHA256

    2ab6b6abe9e3f1d24bf8606a675915e600413c8a9089de5ae3606b595a70aab5

    SHA512

    6269bd39c8682aa9e22422c162034de84cbf1d82ff46c25c7dd04a60759d88958b1ac7e4488f315b4e5e4a3b173af1132eedd741ce99265c6d1c4fab9f94d180

  • C:\Users\Admin\AppData\Local\Temp\LY1pcUrQ.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqa1w54p.ilo.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1460-134-0x0000000004FA0000-0x000000000503C000-memory.dmp

    Filesize

    624KB

  • memory/1460-126-0x0000000072E4E000-0x0000000072E4F000-memory.dmp

    Filesize

    4KB

  • memory/1460-133-0x0000000000690000-0x0000000000698000-memory.dmp

    Filesize

    32KB

  • memory/1460-208-0x0000000072E4E000-0x0000000072E4F000-memory.dmp

    Filesize

    4KB

  • memory/3804-238-0x0000000000F90000-0x0000000000FA2000-memory.dmp

    Filesize

    72KB

  • memory/4156-226-0x00000000009F0000-0x0000000000A00000-memory.dmp

    Filesize

    64KB

  • memory/4528-130-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/4528-209-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/4528-210-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/4628-244-0x000002B372E60000-0x000002B372E82000-memory.dmp

    Filesize

    136KB

  • memory/4896-128-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/4896-0-0x0000000002360000-0x0000000002361000-memory.dmp

    Filesize

    4KB

  • memory/4904-196-0x00007FF9D7850000-0x00007FF9D7860000-memory.dmp

    Filesize

    64KB

  • memory/4904-195-0x00007FF9D7850000-0x00007FF9D7860000-memory.dmp

    Filesize

    64KB

  • memory/4904-194-0x00007FF9D7850000-0x00007FF9D7860000-memory.dmp

    Filesize

    64KB

  • memory/4904-193-0x00007FF9D7850000-0x00007FF9D7860000-memory.dmp

    Filesize

    64KB

  • memory/4904-199-0x00007FF9D4CB0000-0x00007FF9D4CC0000-memory.dmp

    Filesize

    64KB

  • memory/4904-198-0x00007FF9D4CB0000-0x00007FF9D4CC0000-memory.dmp

    Filesize

    64KB

  • memory/4904-197-0x00007FF9D7850000-0x00007FF9D7860000-memory.dmp

    Filesize

    64KB