Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
12/03/2024, 02:06
General
-
Target
$TEMP/syncUpd.exe
-
Size
282KB
-
MD5
54e0220b6f9b4f8f64382b71c6033595
-
SHA1
1f599189588a7a174a6b8a4587ae0df5c15bdd6f
-
SHA256
47bccced008024236587fbe59d8419a52888f7b50b01cc6c7dc92101a0885607
-
SHA512
0c4e27554ee5a090f8e8e1fa0b901cc5cc90fb6f1a3fb68c4a991096d8ea53a07e452d1ad119b046107deffe34173b21a5ff2f0062b98ae9b23945ea05ad8708
-
SSDEEP
3072:h+yppW19jNp4lE4XPx8eHoqKediatEpPbqz8s93GNeL8MOi9P4m8Z:h5m1VN+eImmrdiaAezP8eQtE4h
Malware Config
Extracted
stealc
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Stealc
Stealc is an infostealer written in C++.
-
Detect binaries embedding considerable number of MFA browser extension IDs. 8 IoCs
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 8 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\syncUpd.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
869KB
MD571f8063426825b7f1faf4ae433ae5e90
SHA1fae2ce371eadbb1993819eebc7abdce88c3333df
SHA256500fa7e931db400ed7c283b8c447aac14f49817c9b76fdafe6d4a951642c6dc2
SHA5122eb532422a9cdf34b5454f2d5dc302dc7868f88a6e25f11e0c4228c5bfdd860656c1e70db91cac5f7c02c73a3b58f6e7c884c25098c53b79b213e75c937b52de
-
Filesize
22.2MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
972KB
-
Filesize
22.2MB
-
Filesize
22.2MB
-
Filesize
22.2MB
-
Filesize
22.2MB
-
Filesize
156KB
-
Filesize
22.2MB
-
Filesize
22.2MB
-
Filesize
1024KB