Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
56b7e7de97ef53a4fe73892c9dac41ca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56b7e7de97ef53a4fe73892c9dac41ca.exe
Resource
win10v2004-20231215-en
General
-
Target
56b7e7de97ef53a4fe73892c9dac41ca.exe
-
Size
24KB
-
MD5
56b7e7de97ef53a4fe73892c9dac41ca
-
SHA1
9e2ab768d86c6f686b0f0400e3bc466b2f734139
-
SHA256
090523d3815f51c23ffcbb5a6dd7d48ca3933a5862c1a9c6f49572b0751443f7
-
SHA512
8ad6cb7aa039088628a9717291f7f9f37af813c5786599a1fd552be8d10a6b48b05eab8991bbeeb9e2c6629ddc5b42f26962c52efce063676a2d5a1eee4d0ff6
-
SSDEEP
384:E3eVES+/xwGkRKJ2qKNSlM61qmTTMVF9/q5lCzJ0:bGS+ZfbJuNSO8qYoA/
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 56b7e7de97ef53a4fe73892c9dac41ca.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 56b7e7de97ef53a4fe73892c9dac41ca.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3928 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3988 ipconfig.exe 2248 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3928 tasklist.exe Token: SeDebugPrivilege 2248 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2568 56b7e7de97ef53a4fe73892c9dac41ca.exe 2568 56b7e7de97ef53a4fe73892c9dac41ca.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2568 wrote to memory of 3248 2568 56b7e7de97ef53a4fe73892c9dac41ca.exe 89 PID 2568 wrote to memory of 3248 2568 56b7e7de97ef53a4fe73892c9dac41ca.exe 89 PID 2568 wrote to memory of 3248 2568 56b7e7de97ef53a4fe73892c9dac41ca.exe 89 PID 3248 wrote to memory of 2636 3248 cmd.exe 91 PID 3248 wrote to memory of 2636 3248 cmd.exe 91 PID 3248 wrote to memory of 2636 3248 cmd.exe 91 PID 3248 wrote to memory of 3988 3248 cmd.exe 92 PID 3248 wrote to memory of 3988 3248 cmd.exe 92 PID 3248 wrote to memory of 3988 3248 cmd.exe 92 PID 3248 wrote to memory of 3928 3248 cmd.exe 94 PID 3248 wrote to memory of 3928 3248 cmd.exe 94 PID 3248 wrote to memory of 3928 3248 cmd.exe 94 PID 3248 wrote to memory of 3728 3248 cmd.exe 97 PID 3248 wrote to memory of 3728 3248 cmd.exe 97 PID 3248 wrote to memory of 3728 3248 cmd.exe 97 PID 3728 wrote to memory of 3772 3728 net.exe 98 PID 3728 wrote to memory of 3772 3728 net.exe 98 PID 3728 wrote to memory of 3772 3728 net.exe 98 PID 3248 wrote to memory of 2248 3248 cmd.exe 99 PID 3248 wrote to memory of 2248 3248 cmd.exe 99 PID 3248 wrote to memory of 2248 3248 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b7e7de97ef53a4fe73892c9dac41ca.exe"C:\Users\Admin\AppData\Local\Temp\56b7e7de97ef53a4fe73892c9dac41ca.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2636
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3988
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:3772
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5df132f2fb35dfa2491bf58ef20c475c0
SHA121eccc3e5b06d14599f2111c0dbecd93da630fab
SHA2561ef22f028f468beda8c67f9c47c7a3e7bec23bfc699e5b133da34c2db065b2f4
SHA512d7f13a1ed846364b476ad6e4f93d259d8464ecc5f27e10ec9e54606e966d0f46a6b5dd9eb9a076d3462bf1d6dc229254ef3b88a3ce7cfa8a331f433f80f26e05