Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/01/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
5bd70e23d2370432d65ca88d4c5a1b0c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5bd70e23d2370432d65ca88d4c5a1b0c.exe
Resource
win10v2004-20231222-en
General
-
Target
5bd70e23d2370432d65ca88d4c5a1b0c.exe
-
Size
24KB
-
MD5
5bd70e23d2370432d65ca88d4c5a1b0c
-
SHA1
4c6913e1a81815cba4954218c4044077b21645b1
-
SHA256
e69625526df5a046f8c8b258025c1d5f79786ee1661288d9bbb1326b9dc67822
-
SHA512
ba55bbafe08b01b94d008a6b8c9414eec07d344b41859d75a0a58ac9deedc394f351b3cf6e430fb07811e2821f76e4bd92e626dc38c4abf48e0b9c53671d410d
-
SSDEEP
384:E3eVES+/xwGkRKJ7lM61qmTTMVF9/q5V0:bGS+ZfbJ7O8qYoA6
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 5bd70e23d2370432d65ca88d4c5a1b0c.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 5bd70e23d2370432d65ca88d4c5a1b0c.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1696 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2240 ipconfig.exe 2676 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1696 tasklist.exe Token: SeDebugPrivilege 2676 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2992 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe 28 PID 2232 wrote to memory of 2992 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe 28 PID 2232 wrote to memory of 2992 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe 28 PID 2232 wrote to memory of 2992 2232 5bd70e23d2370432d65ca88d4c5a1b0c.exe 28 PID 2992 wrote to memory of 1196 2992 cmd.exe 30 PID 2992 wrote to memory of 1196 2992 cmd.exe 30 PID 2992 wrote to memory of 1196 2992 cmd.exe 30 PID 2992 wrote to memory of 1196 2992 cmd.exe 30 PID 2992 wrote to memory of 2240 2992 cmd.exe 31 PID 2992 wrote to memory of 2240 2992 cmd.exe 31 PID 2992 wrote to memory of 2240 2992 cmd.exe 31 PID 2992 wrote to memory of 2240 2992 cmd.exe 31 PID 2992 wrote to memory of 1696 2992 cmd.exe 32 PID 2992 wrote to memory of 1696 2992 cmd.exe 32 PID 2992 wrote to memory of 1696 2992 cmd.exe 32 PID 2992 wrote to memory of 1696 2992 cmd.exe 32 PID 2992 wrote to memory of 2648 2992 cmd.exe 34 PID 2992 wrote to memory of 2648 2992 cmd.exe 34 PID 2992 wrote to memory of 2648 2992 cmd.exe 34 PID 2992 wrote to memory of 2648 2992 cmd.exe 34 PID 2648 wrote to memory of 2664 2648 net.exe 35 PID 2648 wrote to memory of 2664 2648 net.exe 35 PID 2648 wrote to memory of 2664 2648 net.exe 35 PID 2648 wrote to memory of 2664 2648 net.exe 35 PID 2992 wrote to memory of 2676 2992 cmd.exe 36 PID 2992 wrote to memory of 2676 2992 cmd.exe 36 PID 2992 wrote to memory of 2676 2992 cmd.exe 36 PID 2992 wrote to memory of 2676 2992 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd70e23d2370432d65ca88d4c5a1b0c.exe"C:\Users\Admin\AppData\Local\Temp\5bd70e23d2370432d65ca88d4c5a1b0c.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1196
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2240
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2664
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d09c6a6f005c4fc10a56e2162250ecc9
SHA163fa82efded444d8dda3d8561fefd0b363c07ebb
SHA2562f7456909632950454009fa553c955a463709b98f3f4bc05cdfe6d16c70be9d8
SHA512a08320c58bc78fb7cd2b44764dc0b7c04f3c9e1e21212492a4cea6dcbe9f72825a2720b0e8470c25dd91a9995321f2c6c462b0dd3d9cb5a5ad3fad07f3da00e6