Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
7b04bb88f11...ea.exe
windows7-x64
10b04bb88f11...ea.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 09:53
Behavioral task
behavioral1
Sample
b04bb88f116e333a5282fcc85205e822b4f3ddb4fb900ff6aab1199537905eea.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b04bb88f116e333a5282fcc85205e822b4f3ddb4fb900ff6aab1199537905eea.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/syncUpd.exe
-
Size
237KB
-
MD5
04bd95c49dbb7391d08d08e5717e8e3f
-
SHA1
daf5d5b340c8a2265709963ae23c89ee18e29720
-
SHA256
7aeafe5281075a0385c73e55edc9cac577968b623e33961975174af6ce8355fb
-
SHA512
13aa59ac47a8401f7913551eeacb097af596d5096122b1309b75bb04efa94018897895a47890b05b21b0ad8e078e7b172a132897e8dae6745ab8b3da7f611d05
-
SSDEEP
3072:5Tuy47ZIsY2azZFoN3jY15e7EfTmxt84Z1LbeMDpfM:5MF7a7q3jYTOGmfXiMd
Malware Config
Extracted
stealc
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2432 DBGIJEHIID.exe -
Loads dropped DLL 1 IoCs
pid Process 1956 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ledger-Live Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBGIJEHIID.exe" DBGIJEHIID.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 syncUpd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString syncUpd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 956 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 syncUpd.exe 2004 syncUpd.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe 2432 DBGIJEHIID.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2432 DBGIJEHIID.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1956 2004 syncUpd.exe 31 PID 2004 wrote to memory of 1956 2004 syncUpd.exe 31 PID 2004 wrote to memory of 1956 2004 syncUpd.exe 31 PID 2004 wrote to memory of 1956 2004 syncUpd.exe 31 PID 2004 wrote to memory of 2124 2004 syncUpd.exe 33 PID 2004 wrote to memory of 2124 2004 syncUpd.exe 33 PID 2004 wrote to memory of 2124 2004 syncUpd.exe 33 PID 2004 wrote to memory of 2124 2004 syncUpd.exe 33 PID 1956 wrote to memory of 2432 1956 cmd.exe 35 PID 1956 wrote to memory of 2432 1956 cmd.exe 35 PID 1956 wrote to memory of 2432 1956 cmd.exe 35 PID 1956 wrote to memory of 2432 1956 cmd.exe 35 PID 2432 wrote to memory of 832 2432 DBGIJEHIID.exe 36 PID 2432 wrote to memory of 832 2432 DBGIJEHIID.exe 36 PID 2432 wrote to memory of 832 2432 DBGIJEHIID.exe 36 PID 2432 wrote to memory of 832 2432 DBGIJEHIID.exe 36 PID 832 wrote to memory of 956 832 cmd.exe 38 PID 832 wrote to memory of 956 832 cmd.exe 38 PID 832 wrote to memory of 956 832 cmd.exe 38 PID 832 wrote to memory of 956 832 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\syncUpd.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DBGIJEHIID.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\DBGIJEHIID.exe"C:\Users\Admin\AppData\Local\Temp\DBGIJEHIID.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DBGIJEHIID.exe4⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30005⤵
- Runs ping.exe
PID:956
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EBGDHJECFC.exe"2⤵PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD542b838cf8bdf67400525e128d917f6e0
SHA1a578f6faec738912dba8c41e7abe1502c46d0cae
SHA2560e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d
SHA512f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0