Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
47fa337fba652cc3a86122f5aa995dea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
47fa337fba652cc3a86122f5aa995dea.exe
Resource
win10v2004-20231215-en
General
-
Target
47fa337fba652cc3a86122f5aa995dea.exe
-
Size
24KB
-
MD5
47fa337fba652cc3a86122f5aa995dea
-
SHA1
3fe0ed520c2acd933f3a18a7b79e905b882df329
-
SHA256
09fa7623a796267286f09a21aa203d494ee06f207771979b59ac95d95fd7c5ac
-
SHA512
ad17c42a0455311a3570e390ff4088fb38480710634991bcae469d5252e9c14da703922a3ca41818c96b881b9bc0c7d53b4447adcd45badc1e4fa3c8cb1ca343
-
SSDEEP
384:E3eVES+/xwGkRKJGvkCKlM61qmTTMVF9/q5x0:bGS+ZfbJGvaO8qYoAu
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 47fa337fba652cc3a86122f5aa995dea.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 47fa337fba652cc3a86122f5aa995dea.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 300 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2592 ipconfig.exe 552 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 300 tasklist.exe Token: SeDebugPrivilege 552 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 47fa337fba652cc3a86122f5aa995dea.exe 2600 47fa337fba652cc3a86122f5aa995dea.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2740 2600 47fa337fba652cc3a86122f5aa995dea.exe 29 PID 2600 wrote to memory of 2740 2600 47fa337fba652cc3a86122f5aa995dea.exe 29 PID 2600 wrote to memory of 2740 2600 47fa337fba652cc3a86122f5aa995dea.exe 29 PID 2600 wrote to memory of 2740 2600 47fa337fba652cc3a86122f5aa995dea.exe 29 PID 2740 wrote to memory of 2576 2740 cmd.exe 31 PID 2740 wrote to memory of 2576 2740 cmd.exe 31 PID 2740 wrote to memory of 2576 2740 cmd.exe 31 PID 2740 wrote to memory of 2576 2740 cmd.exe 31 PID 2740 wrote to memory of 2592 2740 cmd.exe 32 PID 2740 wrote to memory of 2592 2740 cmd.exe 32 PID 2740 wrote to memory of 2592 2740 cmd.exe 32 PID 2740 wrote to memory of 2592 2740 cmd.exe 32 PID 2740 wrote to memory of 300 2740 cmd.exe 33 PID 2740 wrote to memory of 300 2740 cmd.exe 33 PID 2740 wrote to memory of 300 2740 cmd.exe 33 PID 2740 wrote to memory of 300 2740 cmd.exe 33 PID 2740 wrote to memory of 524 2740 cmd.exe 35 PID 2740 wrote to memory of 524 2740 cmd.exe 35 PID 2740 wrote to memory of 524 2740 cmd.exe 35 PID 2740 wrote to memory of 524 2740 cmd.exe 35 PID 524 wrote to memory of 660 524 net.exe 36 PID 524 wrote to memory of 660 524 net.exe 36 PID 524 wrote to memory of 660 524 net.exe 36 PID 524 wrote to memory of 660 524 net.exe 36 PID 2740 wrote to memory of 552 2740 cmd.exe 37 PID 2740 wrote to memory of 552 2740 cmd.exe 37 PID 2740 wrote to memory of 552 2740 cmd.exe 37 PID 2740 wrote to memory of 552 2740 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\47fa337fba652cc3a86122f5aa995dea.exe"C:\Users\Admin\AppData\Local\Temp\47fa337fba652cc3a86122f5aa995dea.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2576
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2592
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:300
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:660
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD538a218f822d29b51e81f41c2f5bbbf87
SHA133796ef8769c9390f5fdc32cf9487c072bd89754
SHA25698fbf42ff196116fc7591209ae7cca478546d0d34805fbd2a451e0ef19b1ddea
SHA5125022c4e7209406b3c934a0fc3a799b74fd88a78767486647c3f96a74007c75d35eeb8bf7be20373a7f1032185c807ca9c0e1905c796917a6ed43db816e977e8e