Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 19:26
General
-
Target
syncUpd.exe
-
Size
314KB
-
MD5
7d03e5cd75616615792ff5da7f630d43
-
SHA1
20dbe01340369c1e10fabf28c898c6f9fff1ae34
-
SHA256
b0810d72555442341dd38d894b2551d1823613bcb747e19ce511da4d5fde3903
-
SHA512
d942769fc2ed3e4a1f6b170a538e8695471857c3c2148ed6c16ed9b148ce962119320e61744e82993c7f73e690828a0022b251ec5ac8d86253f1aeb2d0e43a01
-
SSDEEP
6144:TARL0o0AGim9r1FTMOI8qdDPhfTgYn79oUq:TARX0AGisfQOIfDln7a
Malware Config
Extracted
stealc
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\syncUpd.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
2.2MB
-
Filesize
972KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
2.2MB
-
Filesize
2.2MB