Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
202d5157af744a39a09c25c1b94df7cf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
202d5157af744a39a09c25c1b94df7cf.exe
Resource
win10v2004-20231215-en
General
-
Target
202d5157af744a39a09c25c1b94df7cf.exe
-
Size
24KB
-
MD5
202d5157af744a39a09c25c1b94df7cf
-
SHA1
b692c3a1f8567e43f20c9fdb8cd0fcb9a32b8c07
-
SHA256
5e413395022f7ef850a8afe988b5adbf29b6266ff8a64344d6d9138c2b53c009
-
SHA512
e4a84b9205926500fd2e996fd9d0366050062520f4102d2358d5f3d291dca1147ba0af7e01408fcf5f51f0fb517b4b4709ac1eca7363c600406592402a437a96
-
SSDEEP
384:E3eVES+/xwGkRKJaflM61qmTTMVF9/q5nzJ0:bGS+ZfbJafO8qYoAa
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 202d5157af744a39a09c25c1b94df7cf.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 202d5157af744a39a09c25c1b94df7cf.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1628 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2716 ipconfig.exe 4964 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1628 tasklist.exe Token: SeDebugPrivilege 4964 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2220 202d5157af744a39a09c25c1b94df7cf.exe 2220 202d5157af744a39a09c25c1b94df7cf.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2220 wrote to memory of 676 2220 202d5157af744a39a09c25c1b94df7cf.exe 93 PID 2220 wrote to memory of 676 2220 202d5157af744a39a09c25c1b94df7cf.exe 93 PID 2220 wrote to memory of 676 2220 202d5157af744a39a09c25c1b94df7cf.exe 93 PID 676 wrote to memory of 1224 676 cmd.exe 95 PID 676 wrote to memory of 1224 676 cmd.exe 95 PID 676 wrote to memory of 1224 676 cmd.exe 95 PID 676 wrote to memory of 2716 676 cmd.exe 96 PID 676 wrote to memory of 2716 676 cmd.exe 96 PID 676 wrote to memory of 2716 676 cmd.exe 96 PID 676 wrote to memory of 1628 676 cmd.exe 98 PID 676 wrote to memory of 1628 676 cmd.exe 98 PID 676 wrote to memory of 1628 676 cmd.exe 98 PID 676 wrote to memory of 4840 676 cmd.exe 101 PID 676 wrote to memory of 4840 676 cmd.exe 101 PID 676 wrote to memory of 4840 676 cmd.exe 101 PID 4840 wrote to memory of 1852 4840 net.exe 102 PID 4840 wrote to memory of 1852 4840 net.exe 102 PID 4840 wrote to memory of 1852 4840 net.exe 102 PID 676 wrote to memory of 4964 676 cmd.exe 103 PID 676 wrote to memory of 4964 676 cmd.exe 103 PID 676 wrote to memory of 4964 676 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\202d5157af744a39a09c25c1b94df7cf.exe"C:\Users\Admin\AppData\Local\Temp\202d5157af744a39a09c25c1b94df7cf.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1224
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2716
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1852
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-