Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2023, 08:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GeometryDash.exe
Resource
win7-20230220-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
GeometryDash.exe
Resource
win10v2004-20230220-en
5 signatures
150 seconds
General
-
Target
GeometryDash.exe
-
Size
6.5MB
-
MD5
8c73a34f740b59ee613c6128ad11c2c1
-
SHA1
66788bf78d32238a6a89110afe9ee663ca55f715
-
SHA256
1a91e60510b8c6a5e113b9c089e3020fe71a13b7513392a09f84d3588dbf9c38
-
SHA512
fa7b7426ef6d850cf658739c72f3be77bb545e1d228f09816cd3088d90b42958dede51b4381fdb93f6cabb5a59e74bbc82008e063ed3d4af29a5fd1f91c34b62
-
SSDEEP
49152:pxIv8Yz3qRzSpXyDOZF2LRr9BR3Qa2d1ww6xfS+w6xfSExIlvYqb3xCTjzDyW:k0FJSpyDU2LRTRNVxfS+VxfSgI
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings mspaint.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings mspaint.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 mspaint.exe 3068 mspaint.exe 1980 mspaint.exe 1980 mspaint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4332 OpenWith.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3068 mspaint.exe 4152 OpenWith.exe 1980 mspaint.exe 4332 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"1⤵PID:1716
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseSearch.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:5048
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4152
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseSearch.jpg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4332