Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
0ad6364e0eb5e1c76ce0653277bd3fb6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0ad6364e0eb5e1c76ce0653277bd3fb6.exe
Resource
win10v2004-20231215-en
General
-
Target
0ad6364e0eb5e1c76ce0653277bd3fb6.exe
-
Size
24KB
-
MD5
0ad6364e0eb5e1c76ce0653277bd3fb6
-
SHA1
b36a36472d95d6425c814812404faaefc14804ba
-
SHA256
7e35274d060ebe4c97ea6d499742967bbdd41403ebda9070b612dda0a35a6c49
-
SHA512
ef9c2979d1268c4ddd38a73509ec7e28148e1277e8b934da3cf821022e3e20f6a710e0e61b6d3cd7ec600e1f45aac17f21ae479f95059384be17d5adc269d5ca
-
SSDEEP
384:E3eVES+/xwGkRKJEg/plM61qmTTMVF9/q5T0:bGS+ZfbJPO8qYoAY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 0ad6364e0eb5e1c76ce0653277bd3fb6.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 0ad6364e0eb5e1c76ce0653277bd3fb6.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 868 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5080 ipconfig.exe 976 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 868 tasklist.exe Token: SeDebugPrivilege 976 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2072 0ad6364e0eb5e1c76ce0653277bd3fb6.exe 2072 0ad6364e0eb5e1c76ce0653277bd3fb6.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3968 2072 0ad6364e0eb5e1c76ce0653277bd3fb6.exe 90 PID 2072 wrote to memory of 3968 2072 0ad6364e0eb5e1c76ce0653277bd3fb6.exe 90 PID 2072 wrote to memory of 3968 2072 0ad6364e0eb5e1c76ce0653277bd3fb6.exe 90 PID 3968 wrote to memory of 636 3968 cmd.exe 92 PID 3968 wrote to memory of 636 3968 cmd.exe 92 PID 3968 wrote to memory of 636 3968 cmd.exe 92 PID 3968 wrote to memory of 5080 3968 cmd.exe 94 PID 3968 wrote to memory of 5080 3968 cmd.exe 94 PID 3968 wrote to memory of 5080 3968 cmd.exe 94 PID 3968 wrote to memory of 868 3968 cmd.exe 95 PID 3968 wrote to memory of 868 3968 cmd.exe 95 PID 3968 wrote to memory of 868 3968 cmd.exe 95 PID 3968 wrote to memory of 1204 3968 cmd.exe 97 PID 3968 wrote to memory of 1204 3968 cmd.exe 97 PID 3968 wrote to memory of 1204 3968 cmd.exe 97 PID 1204 wrote to memory of 2976 1204 net.exe 98 PID 1204 wrote to memory of 2976 1204 net.exe 98 PID 1204 wrote to memory of 2976 1204 net.exe 98 PID 3968 wrote to memory of 976 3968 cmd.exe 99 PID 3968 wrote to memory of 976 3968 cmd.exe 99 PID 3968 wrote to memory of 976 3968 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ad6364e0eb5e1c76ce0653277bd3fb6.exe"C:\Users\Admin\AppData\Local\Temp\0ad6364e0eb5e1c76ce0653277bd3fb6.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:636
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5080
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2976
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD551174989deb64e5d32875305e3cdbf4e
SHA198f82d583fdf97be5b7a050fcbff764a839272a9
SHA256cffd0715337a3003a7e96cef3f20cb1add23cb21d20315bafaa0ee35ee17bacc
SHA512ff3bfe45524b7c3430501ac09dbce750ca83e880fb9219b3b1cb5c0d0dd2be24e5957a7c46fc3d7ee40299a4ebbf779b6fb90328011a246160b70cf70048eedf