Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    5s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 13:27 UTC

General

  • Target

    SynapseLauncher.exe

  • Size

    4.1MB

  • MD5

    7d298245f200fa8fdd2da58830b286fb

  • SHA1

    a837c87c6c2c12b8bd1dae3a38bee7468f53907d

  • SHA256

    93e4666d53d8437b111de4bbc936183c3ee505cea719d0faa1d650e6d3cd4634

  • SHA512

    16f36b8b8577f62faebcc3ab148c877a17c208d8e29eb285d904f47b301f8c26c2227ea299c416f626bd62b1b79358ccda741c8b9054fcf0501e40b89792dee6

  • SSDEEP

    98304:Y1bT9OqJzqQ1KtN35Nu7zVFPbCV7aTImb/DXNv8ry4NDDaHN:YZPJm8SN35NMzVFPOQTIm/Nwy4NDC

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\SynapseLauncher.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4016

Network

  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4016-0-0x00007FF62D0C0000-0x00007FF62DB82000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-1-0x00007FFDDAAB0000-0x00007FFDDAAB2000-memory.dmp

    Filesize

    8KB

  • memory/4016-2-0x00007FF62D0C0000-0x00007FF62DB82000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-4-0x00007FF62D0C0000-0x00007FF62DB82000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-3-0x00007FF62D0C0000-0x00007FF62DB82000-memory.dmp

    Filesize

    10.8MB

  • memory/4016-5-0x00007FF62D0C0000-0x00007FF62DB82000-memory.dmp

    Filesize

    10.8MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.