Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

d2d505a494...bb.exe

windows7-x64

9

d2d505a494...bb.exe

windows10-2004-x64

9

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$TEMP/BroomSetup.exe

windows7-x64

9

$TEMP/BroomSetup.exe

windows10-2004-x64

9

$TEMP/syncUpd.exe

windows7-x64

9

$TEMP/syncUpd.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb.exe

  • Size

    1.8MB

  • Sample

    240309-egfg4adc31

  • MD5

    be174eb4ffb7b227b2e78644b98ef1ab

  • SHA1

    f97edc25319588b1c995beb7133daf037a1cca1a

  • SHA256

    d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb

  • SHA512

    1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda

  • SSDEEP

    49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK

Score
10/10
discoveryspywarestealerupx

Malware Config

Targets

    • Target

      d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb.exe

    • Size

      1.8MB

    • MD5

      be174eb4ffb7b227b2e78644b98ef1ab

    • SHA1

      f97edc25319588b1c995beb7133daf037a1cca1a

    • SHA256

      d2d505a4944a92388e3ba620b02cab05c49be2be4e30329113d6da493223e5bb

    • SHA512

      1d03e5ac4ee0caa2abbeda7f11e67d4699b7d35ea488867ffb0809ecc88035c7d53859ba001f02ebc6ad798941a51a31eb27a5c57d8ac4e0ef7552d6a733aeda

    • SSDEEP

      49152:tIiiK2Sqn5EoSHWvIwQ92lUBTI3IUJS6Yy16qvXuK:qiiK2Vwu2FBClYqGK

    Score
    9/10
    discoveryspywarestealerupx

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • UPX dump on OEP (original entry point)

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/INetC.dll

    • Size

      21KB

    • MD5

      2b342079303895c50af8040a91f30f71

    • SHA1

      b11335e1cb8356d9c337cb89fe81d669a69de17e

    • SHA256

      2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

    • SHA512

      550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

    • SSDEEP

      384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i

    Score
    3/10
    behavioral3behavioral4

    • Target

      $TEMP/BroomSetup.exe

    • Size

      1.7MB

    • MD5

      eee5ddcffbed16222cac0a1b4e2e466e

    • SHA1

      28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

    • SHA256

      2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

    • SHA512

      8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

    • SSDEEP

      49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK

    Score
    9/10
    upx

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5behavioral6

    • Target

      $TEMP/syncUpd.exe

    • Size

      229KB

    • MD5

      eda757c6ae24693068781c06550cb3a6

    • SHA1

      026eff85b267da853dac6cc00866bd1cb1c02c4d

    • SHA256

      748733ef6b3518ec18acbf68a3fa7f43e403738a29a275d6cb2df8e87851c277

    • SHA512

      36d171794fa540ecd6112dc1c8f1f393be60af9a1bb8da9e0e64363c390f3c68d370df569738192cfba09361d60e89bac219f0802a5a7c1670c86801c1742060

    • SSDEEP

      6144:/4qdvcItHrBhjlf6R05be5BlXE0tvi7DDu:BRcItHNCR05Sji0UPu

    Score
    9/10
    discoveryspywarestealer

    • Detect binaries embedding considerable number of MFA browser extension IDs.

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks