Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1177s -
max time network
1201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SpectraKinetic.exe
Resource
win10-20231215-en
4 signatures
1200 seconds
Behavioral task
behavioral2
Sample
SpectraKinetic.exe
Resource
win10v2004-20231215-en
4 signatures
1200 seconds
Behavioral task
behavioral3
Sample
SpectraKinetic.exe
Resource
win11-20231215-en
4 signatures
1200 seconds
General
-
Target
SpectraKinetic.exe
-
Size
169KB
-
MD5
950f284c525f5372997af67e082b0bc2
-
SHA1
9bde5a665f3b4d86aa9267b8f587ace95615fbf6
-
SHA256
83deff18d50843ee70ca9bfa8d473521fd6af885a6c925b56f63391aad3ee0f3
-
SHA512
f5f0a8ddd29ea886ca526f56818be74e6b3dda07df00eaad96e31a8ff94ce5e92e8e0b30fe0b4271681e7c42ef04f7ad6a95364db277d783ab0c66bce11aecee
-
SSDEEP
3072:s2AIisquQrYBA5nz55sHI01gEznJw3Z7gWR3lfT:sRsqu/Arso0esqgWR
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpectraKinetic = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pfjsqg\\SpectraKinetic.exe\"" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3360 set thread context of 4456 3360 SpectraKinetic.exe 92 -
Modifies registry key 1 TTPs 3 IoCs
pid Process 948 reg.exe 3484 reg.exe 4316 reg.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3360 wrote to memory of 4456 3360 SpectraKinetic.exe 92 PID 3360 wrote to memory of 4456 3360 SpectraKinetic.exe 92 PID 4456 wrote to memory of 948 4456 msiexec.exe 118 PID 4456 wrote to memory of 948 4456 msiexec.exe 118 PID 4456 wrote to memory of 3484 4456 msiexec.exe 121 PID 4456 wrote to memory of 3484 4456 msiexec.exe 121 PID 4456 wrote to memory of 4316 4456 msiexec.exe 124 PID 4456 wrote to memory of 4316 4456 msiexec.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe"C:\Users\Admin\AppData\Local\Temp\SpectraKinetic.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\System32\msiexec.exe\??\C:\Windows\System32\msiexec.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:948
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:3484
-
-
C:\Windows\System32\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v SpectraKinetic /d "\"C:\Users\Admin\AppData\Roaming\Pfjsqg\SpectraKinetic.exe\""3⤵
- Adds Run key to start application
- Modifies registry key
PID:4316
-
-