Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2025, 15:52

General

  • Target

    0bbe93a978862e8499f795575fe9eb1d.vbs

  • Size

    631B

  • MD5

    0bbe93a978862e8499f795575fe9eb1d

  • SHA1

    995628d7e88ecf1815c7137967fe1a26fe6e2ded

  • SHA256

    c50928dd7e0138f769ffdc30d0be023142ab3765371ec5f046c6389801840384

  • SHA512

    2b05ad6c70b8f72d917eb239ac3efd3c366663218110000714b1dc499e75dec40529c4480d1d58f9854bd6210a09d1024996ed0df13570db8e05a0cb87d6ad47

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

  • Xred family
  • Blocklisted process makes network request 4 IoCs
  • Suspicious Office macro 2 IoCs

    Office document equipped with macros.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 20 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bbe93a978862e8499f795575fe9eb1d.vbs"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Roaming\Acrobat Reader Pro.exe
      "C:\Users\Admin\AppData\Roaming\Acrobat Reader Pro.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Users\Admin\AppData\Local\Temp\._cache_Acrobat Reader Pro.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Acrobat Reader Pro.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn BZVMYP.exe /tr C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe /sc minute /mo 1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn BZVMYP.exe /tr C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe /sc minute /mo 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:556
        • C:\Windows\SysWOW64\WSCript.exe
          WSCript C:\Users\Admin\AppData\Local\Temp\BZVMYP.vbs
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1972
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1644
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {07FE25A6-54DB-4FDF-9114-B330DE9A535B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe
      C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2764
    • C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe
      C:\Users\Admin\AppData\Roaming\Windata\QPIQUE.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa210e236919ccbf95a71a6c0e329c5b

    SHA1

    db5bbd143fcc7d8e4d3257b804c7a6de8edecc16

    SHA256

    dda1491971c93d9c8696c1f88e8233ed842f01876338605481da6a1f3d5e4fe5

    SHA512

    e7268ea9bac4df74ad5579bcf0586098181ed1c4fe7a385395e4e4f679eb95bec608e745af25a3dde97eb8d637b1d5c30148a5d6b662189100f992dbc60bb150

  • C:\Users\Admin\AppData\Local\Temp\BZVMYP.vbs

    Filesize

    872B

    MD5

    f04b4b725042839ece8e6e0bfc0c290d

    SHA1

    11c84bde6c0c43d618f80e959cfd6052fed1ab22

    SHA256

    225c8e1fb959a96277820cdf50acfbe4c52f637e66e9b1fa3efb244eb4624f7e

    SHA512

    2dfeaea3cc25f697f043fa32379aaaae8c9c3492b8c67d90fe5bd44198624687330bdda9d9c270342ac744b6015d11662a91a614b9061e372897ab41df3719a2

  • C:\Users\Admin\AppData\Local\Temp\CabC737.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\ItlbtUjK.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • C:\Users\Admin\AppData\Local\Temp\ItlbtUjK.xlsm

    Filesize

    24KB

    MD5

    c31a7f23a80863f5725c5b94ea34d80e

    SHA1

    0b44ea7f301b5736becf544d7833648257fc9801

    SHA256

    c3d0aaba48d5d6576d17bc5e44a88fcb140c83a6a6678323b49bf5a053630e83

    SHA512

    8d0b19ed97bfb8ac1b21057baf32e861fa923c014712902211727972b21e7460109da07a3957a91507bd0df45a3dea751943965d15aa602b532f22b8ae8f4969

  • C:\Users\Admin\AppData\Local\Temp\ItlbtUjK.xlsm

    Filesize

    29KB

    MD5

    2d38c53e7f7fe2eb1a7cf70096488f39

    SHA1

    679e1eee457e13977df386d9b037c6fe015f20e1

    SHA256

    dea65d5b13786a029d04705cbb44feb06045670b96439f02ea52aa2e1edf1687

    SHA512

    1c2447d7321ac385fde3ef40fd3ce8e38b8d5115dc882a87588e637dce1d0d2731c875e6bf9d9ec3dfa70e4814d9239941a693d2a001bf6f420d48fcb5b7667d

  • C:\Users\Admin\AppData\Local\Temp\ItlbtUjK.xlsm

    Filesize

    28KB

    MD5

    e73145ee1e9e39d7bc61023e17776e66

    SHA1

    2e12fd4fd44ba9c271f1aa595e92943f9dcae945

    SHA256

    0f1c50387b66f59b09c6c0a706f06c3dbac9deb415c027e3c5718ae4e5ea623b

    SHA512

    73bf6ced51b961ae790c208f6121b3e70ae99ed81a1df0136c5f0d882be29dab91537c6842b29bbc8c8dcfb667ac4417b8206f43aaeb919ad7e432ff143484c2

  • C:\Users\Admin\AppData\Local\Temp\ItlbtUjK.xlsm

    Filesize

    26KB

    MD5

    246206a29e47e50a3a49f4141cece4f7

    SHA1

    117f4317c94a882f2f60db15e358fd855b1f89fa

    SHA256

    4a0fc91dc34063f322a30e79561c3cf960cd8af58a2601a1f787b7e1a9e13b97

    SHA512

    d1a7417235e96323f0063c0ebab80213dcf3f4dbb1f8bb89032079126e278a09d0342064ede66827772ff65fed2d352fce79dce3fe58d6ec26e5b0fd2e590098

  • C:\Users\Admin\AppData\Local\Temp\TarC75A.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\~$ItlbtUjK.xlsm

    Filesize

    165B

    MD5

    ff09371174f7c701e75f357a187c06e8

    SHA1

    57f9a638fd652922d7eb23236c80055a91724503

    SHA256

    e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

    SHA512

    e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

  • C:\Users\Admin\AppData\Roaming\Acrobat Reader Pro.exe

    Filesize

    1.6MB

    MD5

    57613e500e19529395aa3641fc31249a

    SHA1

    cfe9ce49ea9b8760e73d28c9002d09bbfbfa1f0a

    SHA256

    dffc9f522a7bb30c10ef8bdc6acb27d2d634b97c4d35c6f9e6842ecafd77edef

    SHA512

    b8678275698490d5cc3ad5075e148cf756187f358b5ef6f5c9a8886e3c6b75890065aface25cc87f3513012222be3e33fdc8178d47a1553c0dbed6fc57317986

  • \Users\Admin\AppData\Local\Temp\._cache_Acrobat Reader Pro.exe

    Filesize

    895KB

    MD5

    1ca102e7cb8545ef3b191e8fd6cb2f43

    SHA1

    a472cd3a9d23f57ff4590d71cb48ae1fc2537d20

    SHA256

    acb772304cdae76230b6806406c160aa9defa61721a04fefc9372d8760021916

    SHA512

    4e7d5f470d654ae472ed4853a0b361ea160717974d125cc419da75ac98d2cdd85b7ac7891dfdc7d7b042dbd67e2679332151a5a21923351ecd6125df0a9a950e

  • memory/1644-113-0x0000000001100000-0x00000000012F0000-memory.dmp

    Filesize

    1.9MB

  • memory/1644-111-0x0000000001100000-0x00000000012F0000-memory.dmp

    Filesize

    1.9MB

  • memory/1732-192-0x0000000005570000-0x0000000005760000-memory.dmp

    Filesize

    1.9MB

  • memory/1732-241-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/1732-110-0x0000000005570000-0x0000000005760000-memory.dmp

    Filesize

    1.9MB

  • memory/1732-193-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/1948-245-0x0000000001160000-0x0000000001350000-memory.dmp

    Filesize

    1.9MB

  • memory/1948-247-0x0000000001160000-0x0000000001350000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-205-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-248-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-258-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-190-0x0000000000C00000-0x0000000000C10000-memory.dmp

    Filesize

    64KB

  • memory/2028-191-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-99-0x0000000000C00000-0x0000000000C10000-memory.dmp

    Filesize

    64KB

  • memory/2028-194-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-256-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-254-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-201-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-203-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-81-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-250-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-252-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-209-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-240-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-242-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2028-189-0x0000000000060000-0x0000000000250000-memory.dmp

    Filesize

    1.9MB

  • memory/2676-92-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/2676-61-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2676-74-0x0000000005580000-0x0000000005770000-memory.dmp

    Filesize

    1.9MB

  • memory/2764-200-0x0000000001160000-0x0000000001350000-memory.dmp

    Filesize

    1.9MB

  • memory/2764-198-0x0000000001160000-0x0000000001350000-memory.dmp

    Filesize

    1.9MB

  • memory/2956-188-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2956-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB