Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 19:04
Behavioral task
behavioral1
Sample
941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe
Resource
win10v2004-20241007-en
General
-
Target
941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe
-
Size
1.1MB
-
MD5
9dfca0b4a10e24e0b2c8f1fd35a035e1
-
SHA1
56a525fe9a4fdd1c69c09cc78114d15bc8b04c46
-
SHA256
941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0
-
SHA512
16c30294ba741571e00905d95a62eccd81391ebaa029849142186986b452f17d92366bddc4ce05db64edca9aa8abacb554ad0cfb21eaa7df7ad3567608d119b9
-
SSDEEP
24576:tnsJ39LyjbJkQFMhmC+6GD9ICnzZSpz8LkQ:tnsHyjtk2MYC5GDHzk0V
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 3 IoCs
pid Process 3744 ._cache_941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 1916 Synaptics.exe 4500 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2752 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2752 EXCEL.EXE 2752 EXCEL.EXE 2752 EXCEL.EXE 2752 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3744 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 83 PID 4676 wrote to memory of 3744 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 83 PID 4676 wrote to memory of 3744 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 83 PID 4676 wrote to memory of 1916 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 85 PID 4676 wrote to memory of 1916 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 85 PID 4676 wrote to memory of 1916 4676 941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe 85 PID 1916 wrote to memory of 4500 1916 Synaptics.exe 86 PID 1916 wrote to memory of 4500 1916 Synaptics.exe 86 PID 1916 wrote to memory of 4500 1916 Synaptics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe"C:\Users\Admin\AppData\Local\Temp\941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\._cache_941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe"C:\Users\Admin\AppData\Local\Temp\._cache_941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59dfca0b4a10e24e0b2c8f1fd35a035e1
SHA156a525fe9a4fdd1c69c09cc78114d15bc8b04c46
SHA256941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0
SHA51216c30294ba741571e00905d95a62eccd81391ebaa029849142186986b452f17d92366bddc4ce05db64edca9aa8abacb554ad0cfb21eaa7df7ad3567608d119b9
-
C:\Users\Admin\AppData\Local\Temp\._cache_941c9d80c8c221e6bd33d75d01b8404027ca98e344279c8b94d5c639f94118a0.exe
Filesize369KB
MD55fcfe9a4da55421bda55959ebb67b1b2
SHA142cae4b098a43c725048036ba0eb65ac992254e5
SHA25650e22fd9d37c6b1e14a86b5e4440aaaa4d2a20d1dd8f83d2c9e19915f45b61ff
SHA512dfc69fa7508c1b08c233988eff0d4b4479c6548a1e489d3be8d2f185a4b8993cda159e4979ca94359e11c039e8bd7f2e660e6a7df5c032c64400b64e03ef4457
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04