Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1174s
  • max time network
    1175s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/01/2024, 23:54

General

  • Target

    SpectraKinetic.exe

  • Size

    169KB

  • MD5

    950f284c525f5372997af67e082b0bc2

  • SHA1

    9bde5a665f3b4d86aa9267b8f587ace95615fbf6

  • SHA256

    83deff18d50843ee70ca9bfa8d473521fd6af885a6c925b56f63391aad3ee0f3

  • SHA512

    f5f0a8ddd29ea886ca526f56818be74e6b3dda07df00eaad96e31a8ff94ce5e92e8e0b30fe0b4271681e7c42ef04f7ad6a95364db277d783ab0c66bce11aecee

  • SSDEEP

    3072:s2AIisquQrYBA5nz55sHI01gEznJw3Z7gWR3lfT:sRsqu/Arso0esqgWR

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe
    "C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Windows\System32\msiexec.exe
      \??\C:\Windows\System32\msiexec.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\System32\reg.exe
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:5088
      • C:\Windows\System32\reg.exe
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1104
      • C:\Windows\System32\reg.exe
        reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4412-0-0x000002033C950000-0x000002033CB2B000-memory.dmp

    Filesize

    1.9MB

  • memory/4792-9-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-13-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-14-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-18-0x000001D226A30000-0x000001D226C0B000-memory.dmp

    Filesize

    1.9MB

  • memory/4792-28-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-29-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-30-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-31-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-32-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-33-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-34-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-35-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-36-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB

  • memory/4792-37-0x000001D224680000-0x000001D2246C0000-memory.dmp

    Filesize

    256KB