Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
1b5b2959570cded90de2026af45870f9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b5b2959570cded90de2026af45870f9.exe
Resource
win10v2004-20231215-en
General
-
Target
1b5b2959570cded90de2026af45870f9.exe
-
Size
24KB
-
MD5
1b5b2959570cded90de2026af45870f9
-
SHA1
c15a49e0ff515adb6ad7d80bd55192d29f682866
-
SHA256
637187013f30d12855bae6f3e4c33824a06485ec75f3d452c733895b28ca9d77
-
SHA512
0a1eb247e47f2d1c1f5bd9596875a980c85812057c69408a8e3ec4f2e29fa6133ba498117aff2d0deaa3fc9c9bcb0897368e320f8d01fa29797bed75e65108b5
-
SSDEEP
384:E3eVES+/xwGkRKJL1lM61qmTTMVF9/q5IjN0:bGS+ZfbJBO8qYoAIW
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 1b5b2959570cded90de2026af45870f9.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 1b5b2959570cded90de2026af45870f9.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4852 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3732 ipconfig.exe 5116 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4852 tasklist.exe Token: SeDebugPrivilege 5116 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2812 1b5b2959570cded90de2026af45870f9.exe 2812 1b5b2959570cded90de2026af45870f9.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2812 wrote to memory of 1552 2812 1b5b2959570cded90de2026af45870f9.exe 88 PID 2812 wrote to memory of 1552 2812 1b5b2959570cded90de2026af45870f9.exe 88 PID 2812 wrote to memory of 1552 2812 1b5b2959570cded90de2026af45870f9.exe 88 PID 1552 wrote to memory of 2816 1552 cmd.exe 90 PID 1552 wrote to memory of 2816 1552 cmd.exe 90 PID 1552 wrote to memory of 2816 1552 cmd.exe 90 PID 1552 wrote to memory of 3732 1552 cmd.exe 91 PID 1552 wrote to memory of 3732 1552 cmd.exe 91 PID 1552 wrote to memory of 3732 1552 cmd.exe 91 PID 1552 wrote to memory of 4852 1552 cmd.exe 92 PID 1552 wrote to memory of 4852 1552 cmd.exe 92 PID 1552 wrote to memory of 4852 1552 cmd.exe 92 PID 1552 wrote to memory of 1316 1552 cmd.exe 94 PID 1552 wrote to memory of 1316 1552 cmd.exe 94 PID 1552 wrote to memory of 1316 1552 cmd.exe 94 PID 1316 wrote to memory of 2784 1316 net.exe 95 PID 1316 wrote to memory of 2784 1316 net.exe 95 PID 1316 wrote to memory of 2784 1316 net.exe 95 PID 1552 wrote to memory of 5116 1552 cmd.exe 96 PID 1552 wrote to memory of 5116 1552 cmd.exe 96 PID 1552 wrote to memory of 5116 1552 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5b2959570cded90de2026af45870f9.exe"C:\Users\Admin\AppData\Local\Temp\1b5b2959570cded90de2026af45870f9.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2816
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3732
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2784
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5f5e7168ad72d9e70c4e63685fca8f6fa
SHA13db69fb480993b23e78ebc37fc96c6fd32ae7559
SHA256aac7602f5f9b4fb46b3a485aca3159dfbed911aaaf27e23802d9d57707c6c469
SHA51251e05ebc6fce4e2d6e236719c7d2f486358e159882fee3b661fc2f54622346558a17580ea85d437e4a4c66822863f70ce29c3494b4985634c69a3316a6cbc133