Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
191s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
47fa337fba652cc3a86122f5aa995dea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
47fa337fba652cc3a86122f5aa995dea.exe
Resource
win10v2004-20231215-en
General
-
Target
47fa337fba652cc3a86122f5aa995dea.exe
-
Size
24KB
-
MD5
47fa337fba652cc3a86122f5aa995dea
-
SHA1
3fe0ed520c2acd933f3a18a7b79e905b882df329
-
SHA256
09fa7623a796267286f09a21aa203d494ee06f207771979b59ac95d95fd7c5ac
-
SHA512
ad17c42a0455311a3570e390ff4088fb38480710634991bcae469d5252e9c14da703922a3ca41818c96b881b9bc0c7d53b4447adcd45badc1e4fa3c8cb1ca343
-
SSDEEP
384:E3eVES+/xwGkRKJGvkCKlM61qmTTMVF9/q5x0:bGS+ZfbJGvaO8qYoAu
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 47fa337fba652cc3a86122f5aa995dea.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 47fa337fba652cc3a86122f5aa995dea.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4024 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2876 NETSTAT.EXE 1944 ipconfig.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4024 tasklist.exe Token: SeDebugPrivilege 2876 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3220 47fa337fba652cc3a86122f5aa995dea.exe 3220 47fa337fba652cc3a86122f5aa995dea.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3220 wrote to memory of 2976 3220 47fa337fba652cc3a86122f5aa995dea.exe 88 PID 3220 wrote to memory of 2976 3220 47fa337fba652cc3a86122f5aa995dea.exe 88 PID 3220 wrote to memory of 2976 3220 47fa337fba652cc3a86122f5aa995dea.exe 88 PID 2976 wrote to memory of 2924 2976 cmd.exe 90 PID 2976 wrote to memory of 2924 2976 cmd.exe 90 PID 2976 wrote to memory of 2924 2976 cmd.exe 90 PID 2976 wrote to memory of 1944 2976 cmd.exe 91 PID 2976 wrote to memory of 1944 2976 cmd.exe 91 PID 2976 wrote to memory of 1944 2976 cmd.exe 91 PID 2976 wrote to memory of 4024 2976 cmd.exe 93 PID 2976 wrote to memory of 4024 2976 cmd.exe 93 PID 2976 wrote to memory of 4024 2976 cmd.exe 93 PID 2976 wrote to memory of 3768 2976 cmd.exe 95 PID 2976 wrote to memory of 3768 2976 cmd.exe 95 PID 2976 wrote to memory of 3768 2976 cmd.exe 95 PID 3768 wrote to memory of 1004 3768 net.exe 96 PID 3768 wrote to memory of 1004 3768 net.exe 96 PID 3768 wrote to memory of 1004 3768 net.exe 96 PID 2976 wrote to memory of 2876 2976 cmd.exe 97 PID 2976 wrote to memory of 2876 2976 cmd.exe 97 PID 2976 wrote to memory of 2876 2976 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\47fa337fba652cc3a86122f5aa995dea.exe"C:\Users\Admin\AppData\Local\Temp\47fa337fba652cc3a86122f5aa995dea.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2924
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1944
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1004
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5d5f720d44b12b7295a6f47b8d62be065
SHA1d4c76a2576c9812fc461023cba9d66568686095f
SHA25623243472c061b1fcebaf662fe5b3c594fbdce317fc79cbeb8b3c3f99a4c670ec
SHA512bd7e043f2c3c8b66ef8aa911b71d1b0363a16ed3f9c7af940df9be483aeeaa0acef5c4ee48a0274c03ff5d099f07549dd2e882f9196e5944d35543c062376b91