Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

GeometryDash.exe

windows7-x64

1

GeometryDash.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 08:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GeometryDash.exe

  • Size

    6.5MB

  • MD5

    8c73a34f740b59ee613c6128ad11c2c1

  • SHA1

    66788bf78d32238a6a89110afe9ee663ca55f715

  • SHA256

    1a91e60510b8c6a5e113b9c089e3020fe71a13b7513392a09f84d3588dbf9c38

  • SHA512

    fa7b7426ef6d850cf658739c72f3be77bb545e1d228f09816cd3088d90b42958dede51b4381fdb93f6cabb5a59e74bbc82008e063ed3d4af29a5fd1f91c34b62

  • SSDEEP

    49152:pxIv8Yz3qRzSpXyDOZF2LRr9BR3Qa2d1ww6xfS+w6xfSExIlvYqb3xCTjzDyW:k0FJSpyDU2LRTRNVxfS+VxfSgI

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 11 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe
    "C:\Users\Admin\AppData\Local\Temp\GeometryDash.exe"
    1⤵
      PID:1716
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseSearch.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3068
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:5048
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4152
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CloseSearch.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1980
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4332

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5048-133-0x000001ACFFB60000-0x000001ACFFB70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5048-137-0x000001ACFFBA0000-0x000001ACFFBB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5048-144-0x000001ACFFE60000-0x000001ACFFE61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-146-0x000001ACFFEE0000-0x000001ACFFEE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-148-0x000001ACFFEE0000-0x000001ACFFEE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-149-0x000001ACFFF70000-0x000001ACFFF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-150-0x000001ACFFF70000-0x000001ACFFF71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-151-0x000001ACFFF80000-0x000001ACFFF81000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5048-152-0x000001ACFFF80000-0x000001ACFFF81000-memory.dmp

      Filesize

      4KB

      Download