Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
40e30893fffd8d3add2c9bf05b090787.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
40e30893fffd8d3add2c9bf05b090787.exe
Resource
win10v2004-20231215-en
General
-
Target
40e30893fffd8d3add2c9bf05b090787.exe
-
Size
24KB
-
MD5
40e30893fffd8d3add2c9bf05b090787
-
SHA1
372e63c8bdc4da260d0181a76a338a819a90e735
-
SHA256
98e598bb032d1a79674c2750145420c25478ce7f6d38732921e8208979212c0b
-
SHA512
5075a748d98e83f96c852d16006fa3db516d64cb61b6dff3aa9e6738e6085fcd657e4bd448a7192a4e8bbe5ce53484a62ff463dfd11ae8753dfb77ab2fe8cf16
-
SSDEEP
384:E3eVES+/xwGkRKJolM61qmTTMVF9/q5h0:bGS+ZfbJoO8qYoA+
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 40e30893fffd8d3add2c9bf05b090787.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 40e30893fffd8d3add2c9bf05b090787.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2488 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2336 ipconfig.exe 2608 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2488 tasklist.exe Token: SeDebugPrivilege 2608 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1068 40e30893fffd8d3add2c9bf05b090787.exe 1068 40e30893fffd8d3add2c9bf05b090787.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2272 1068 40e30893fffd8d3add2c9bf05b090787.exe 28 PID 1068 wrote to memory of 2272 1068 40e30893fffd8d3add2c9bf05b090787.exe 28 PID 1068 wrote to memory of 2272 1068 40e30893fffd8d3add2c9bf05b090787.exe 28 PID 1068 wrote to memory of 2272 1068 40e30893fffd8d3add2c9bf05b090787.exe 28 PID 2272 wrote to memory of 2748 2272 cmd.exe 30 PID 2272 wrote to memory of 2748 2272 cmd.exe 30 PID 2272 wrote to memory of 2748 2272 cmd.exe 30 PID 2272 wrote to memory of 2748 2272 cmd.exe 30 PID 2272 wrote to memory of 2336 2272 cmd.exe 31 PID 2272 wrote to memory of 2336 2272 cmd.exe 31 PID 2272 wrote to memory of 2336 2272 cmd.exe 31 PID 2272 wrote to memory of 2336 2272 cmd.exe 31 PID 2272 wrote to memory of 2488 2272 cmd.exe 32 PID 2272 wrote to memory of 2488 2272 cmd.exe 32 PID 2272 wrote to memory of 2488 2272 cmd.exe 32 PID 2272 wrote to memory of 2488 2272 cmd.exe 32 PID 2272 wrote to memory of 2548 2272 cmd.exe 34 PID 2272 wrote to memory of 2548 2272 cmd.exe 34 PID 2272 wrote to memory of 2548 2272 cmd.exe 34 PID 2272 wrote to memory of 2548 2272 cmd.exe 34 PID 2548 wrote to memory of 2552 2548 net.exe 35 PID 2548 wrote to memory of 2552 2548 net.exe 35 PID 2548 wrote to memory of 2552 2548 net.exe 35 PID 2548 wrote to memory of 2552 2548 net.exe 35 PID 2272 wrote to memory of 2608 2272 cmd.exe 36 PID 2272 wrote to memory of 2608 2272 cmd.exe 36 PID 2272 wrote to memory of 2608 2272 cmd.exe 36 PID 2272 wrote to memory of 2608 2272 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\40e30893fffd8d3add2c9bf05b090787.exe"C:\Users\Admin\AppData\Local\Temp\40e30893fffd8d3add2c9bf05b090787.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2748
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2336
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2552
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5e986b50e20a86233818c58d9cc289c83
SHA1f396132d2e9d585a48e057b56362ff6975b5996c
SHA256d24de0e25a157b3d00dc300e5609aa4e76666d5fdf191a4169783a1013a73e0c
SHA51225baa6dcd2b14d400cc9dfcaaa7f8335f7976bbec7f7615ce5d2fd86f9da77c3d764840dc43bcf654a1086daa04ddb0222fb6a390376ee6390a83d52abde50d8