Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

GeometryDash.exe

windows10-1703-x64

1

Analysis

  • max time kernel
    122s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    15/03/2023, 06:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GeometryDash.exe

  • Size

    3.7MB

  • MD5

    0209b19711760cc8bed6692fe149e100

  • SHA1

    fe206835bd27097d5ccc0af76e368eaad257b814

  • SHA256

    c159743d8ec97ee16764e58d629ec634ce0d61cbfe4cfd1855ef64fdcb6ddffa

  • SHA512

    93e17428ea68e32b310d20fcfe34080b76ba8992f0daa8f380a5b4c31220865380f9a53c6d4463005fb1452b05722df70a3ec4f64376dfb61ee425b654bc11f3

  • SSDEEP

    24576:XMcvZv/x3C29idsH6E+QhGxgaboUqdDvF9n9w6MEfSe7DhH+akiqAZLtna1kPwE5:8ZnoUqLw6xfSKDt+VsLtZPwEm

Score
1/10

Malware Config

Signatures

  • Modifies registry class 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe
    "C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"
    1⤵
      PID:1472
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2632
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1956
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4028
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2880
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3856
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\AssertDisable\" -spe -an -ai#7zMap23012:84:7zEvent23532
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2980

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1472-121-0x0000000000400000-0x00000000007AF000-memory.dmp

        Filesize

        3.7MB

        Download