Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
5a0f6ca33a29b18b530ae30b2a7e9b97.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5a0f6ca33a29b18b530ae30b2a7e9b97.exe
Resource
win10v2004-20231222-en
General
-
Target
5a0f6ca33a29b18b530ae30b2a7e9b97.exe
-
Size
24KB
-
MD5
5a0f6ca33a29b18b530ae30b2a7e9b97
-
SHA1
3b4e8982627749baa2549fdffc7df92ca29541a6
-
SHA256
d1563306e5a17b4ec58086b75732cde95f43a7f8a36985584edb09f706f5db2d
-
SHA512
abf456ea74cd5b423300eaf4c0eb4196dc8c880c5a037bd84652f6905ebdc9bdf0b3ffbb8eb532d90e54f99996f236447889bc5348069b0fbf2d34c909e46a5b
-
SSDEEP
384:E3eVES+/xwGkRKJgtDvlM61qmTTMVF9/q5C0:bGS+ZfbJAvO8qYoAD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 5a0f6ca33a29b18b530ae30b2a7e9b97.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 5a0f6ca33a29b18b530ae30b2a7e9b97.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3004 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 664 ipconfig.exe 1064 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3004 tasklist.exe Token: SeDebugPrivilege 1064 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4168 5a0f6ca33a29b18b530ae30b2a7e9b97.exe 4168 5a0f6ca33a29b18b530ae30b2a7e9b97.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4168 wrote to memory of 3484 4168 5a0f6ca33a29b18b530ae30b2a7e9b97.exe 87 PID 4168 wrote to memory of 3484 4168 5a0f6ca33a29b18b530ae30b2a7e9b97.exe 87 PID 4168 wrote to memory of 3484 4168 5a0f6ca33a29b18b530ae30b2a7e9b97.exe 87 PID 3484 wrote to memory of 800 3484 cmd.exe 89 PID 3484 wrote to memory of 800 3484 cmd.exe 89 PID 3484 wrote to memory of 800 3484 cmd.exe 89 PID 3484 wrote to memory of 664 3484 cmd.exe 90 PID 3484 wrote to memory of 664 3484 cmd.exe 90 PID 3484 wrote to memory of 664 3484 cmd.exe 90 PID 3484 wrote to memory of 3004 3484 cmd.exe 91 PID 3484 wrote to memory of 3004 3484 cmd.exe 91 PID 3484 wrote to memory of 3004 3484 cmd.exe 91 PID 3484 wrote to memory of 5732 3484 cmd.exe 94 PID 3484 wrote to memory of 5732 3484 cmd.exe 94 PID 3484 wrote to memory of 5732 3484 cmd.exe 94 PID 5732 wrote to memory of 4772 5732 net.exe 95 PID 5732 wrote to memory of 4772 5732 net.exe 95 PID 5732 wrote to memory of 4772 5732 net.exe 95 PID 3484 wrote to memory of 1064 3484 cmd.exe 96 PID 3484 wrote to memory of 1064 3484 cmd.exe 96 PID 3484 wrote to memory of 1064 3484 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0f6ca33a29b18b530ae30b2a7e9b97.exe"C:\Users\Admin\AppData\Local\Temp\5a0f6ca33a29b18b530ae30b2a7e9b97.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:800
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:664
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4772
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5e0fedec2b422773bdf467ab6101276ed
SHA1f5f647d945242c2d42648e3e9647917dab4c195f
SHA25670476f4ed53602d3de12b42ef24785143787a28a25d913e47384c83f2233dd47
SHA512bb1986988bd2a3673279ffd3ca3d7f9458a05bcfb97133ea21486da84f4a6ab2ac9f0202d1d3d62221bb1e1dba89d506d3457b685ce1b2b6d9b46010bd977447