Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1174s -
max time network
1175s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
13/01/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SpectraKinetic.exe
Resource
win10-20231215-en
4 signatures
1200 seconds
Behavioral task
behavioral2
Sample
SpectraKinetic.exe
Resource
win10v2004-20231215-en
4 signatures
1200 seconds
Behavioral task
behavioral3
Sample
SpectraKinetic.exe
Resource
win11-20231215-en
4 signatures
1200 seconds
General
-
Target
SpectraKinetic.exe
-
Size
169KB
-
MD5
950f284c525f5372997af67e082b0bc2
-
SHA1
9bde5a665f3b4d86aa9267b8f587ace95615fbf6
-
SHA256
83deff18d50843ee70ca9bfa8d473521fd6af885a6c925b56f63391aad3ee0f3
-
SHA512
f5f0a8ddd29ea886ca526f56818be74e6b3dda07df00eaad96e31a8ff94ce5e92e8e0b30fe0b4271681e7c42ef04f7ad6a95364db277d783ab0c66bce11aecee
-
SSDEEP
3072:s2AIisquQrYBA5nz55sHI01gEznJw3Z7gWR3lfT:sRsqu/Arso0esqgWR
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4412 set thread context of 4792 4412 SpectraKinetic.exe 74 -
Modifies registry key 1 TTPs 3 IoCs
pid Process 5088 reg.exe 1104 reg.exe 1480 reg.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4792 4412 SpectraKinetic.exe 74 PID 4412 wrote to memory of 4792 4412 SpectraKinetic.exe 74 PID 4792 wrote to memory of 5088 4792 msiexec.exe 75 PID 4792 wrote to memory of 5088 4792 msiexec.exe 75 PID 4792 wrote to memory of 1104 4792 msiexec.exe 77 PID 4792 wrote to memory of 1104 4792 msiexec.exe 77 PID 4792 wrote to memory of 1480 4792 msiexec.exe 79 PID 4792 wrote to memory of 1480 4792 msiexec.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe"C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\System32\msiexec.exe\??\C:\Windows\System32\msiexec.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:5088
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:1104
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:1480
-
-