Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
2472350d154e6838668971e5bc5f75cf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2472350d154e6838668971e5bc5f75cf.exe
Resource
win10v2004-20231215-en
General
-
Target
2472350d154e6838668971e5bc5f75cf.exe
-
Size
24KB
-
MD5
2472350d154e6838668971e5bc5f75cf
-
SHA1
4c3e627eb19b1216f3ac68560b2eff5e8ab86a51
-
SHA256
949c9c1dbc934c93a83c59fb378d080a92dd0afeef8d1024c6ac607fa447cd49
-
SHA512
e8698d3ba81035d7ea514b6daf2a574b45a9fecda3dc97b1f1e3af78aef709f539fccf8d0140cdaecd51d828e89e2194d994a4bd81c4216b9cad61f2c7ceb67c
-
SSDEEP
384:E3eVES+/xwGkRKJr9lM61qmTTMVF9/q5Y0:bGS+ZfbJZO8qYoAh
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 2472350d154e6838668971e5bc5f75cf.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 2472350d154e6838668971e5bc5f75cf.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2308 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2828 ipconfig.exe 2692 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 tasklist.exe Token: SeDebugPrivilege 2692 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 2472350d154e6838668971e5bc5f75cf.exe 3008 2472350d154e6838668971e5bc5f75cf.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2320 3008 2472350d154e6838668971e5bc5f75cf.exe 28 PID 3008 wrote to memory of 2320 3008 2472350d154e6838668971e5bc5f75cf.exe 28 PID 3008 wrote to memory of 2320 3008 2472350d154e6838668971e5bc5f75cf.exe 28 PID 3008 wrote to memory of 2320 3008 2472350d154e6838668971e5bc5f75cf.exe 28 PID 2320 wrote to memory of 2688 2320 cmd.exe 30 PID 2320 wrote to memory of 2688 2320 cmd.exe 30 PID 2320 wrote to memory of 2688 2320 cmd.exe 30 PID 2320 wrote to memory of 2688 2320 cmd.exe 30 PID 2320 wrote to memory of 2828 2320 cmd.exe 31 PID 2320 wrote to memory of 2828 2320 cmd.exe 31 PID 2320 wrote to memory of 2828 2320 cmd.exe 31 PID 2320 wrote to memory of 2828 2320 cmd.exe 31 PID 2320 wrote to memory of 2308 2320 cmd.exe 32 PID 2320 wrote to memory of 2308 2320 cmd.exe 32 PID 2320 wrote to memory of 2308 2320 cmd.exe 32 PID 2320 wrote to memory of 2308 2320 cmd.exe 32 PID 2320 wrote to memory of 804 2320 cmd.exe 34 PID 2320 wrote to memory of 804 2320 cmd.exe 34 PID 2320 wrote to memory of 804 2320 cmd.exe 34 PID 2320 wrote to memory of 804 2320 cmd.exe 34 PID 804 wrote to memory of 2884 804 net.exe 35 PID 804 wrote to memory of 2884 804 net.exe 35 PID 804 wrote to memory of 2884 804 net.exe 35 PID 804 wrote to memory of 2884 804 net.exe 35 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2692 2320 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\2472350d154e6838668971e5bc5f75cf.exe"C:\Users\Admin\AppData\Local\Temp\2472350d154e6838668971e5bc5f75cf.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2688
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2828
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2884
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD55e9469c3b2a4a5b3a276881c727f7f73
SHA10184f428a6126aec60b8ced0dad4a4018a42a2ec
SHA2569d9d09d3426a867868aef1f0539b4187f25bcd0692382f5b39fd65bb8205676d
SHA512f41285897511a7548320197eebccdf1c9a7f815be62b00d4e84e853e9921bf8cd654a89956a27833c26e7f333dd21a76ebd72930094a592319be0284ca943956