Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
72387b030f7c483053c62ce90c2c344d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72387b030f7c483053c62ce90c2c344d.exe
Resource
win10v2004-20231215-en
General
-
Target
72387b030f7c483053c62ce90c2c344d.exe
-
Size
24KB
-
MD5
72387b030f7c483053c62ce90c2c344d
-
SHA1
1c1c609e6c692a82501dfd40f252b28cd1813ec7
-
SHA256
3c8c6fd2425994115ec2f3d88111a8feee9e75f6919b4446805247cfce52ba02
-
SHA512
adc18428a2bb2efa8de302146f09e550e0fbbefbba05cb62d1faa6e638d29b9426a32c4466a68ea68f5baa4eb18b42352b77c28adebdbcb779283103648be0a7
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5C0:bGS+ZfbJiO8qYoAD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 72387b030f7c483053c62ce90c2c344d.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 72387b030f7c483053c62ce90c2c344d.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2712 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3068 ipconfig.exe 2844 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2712 tasklist.exe Token: SeDebugPrivilege 2844 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 72387b030f7c483053c62ce90c2c344d.exe 2276 72387b030f7c483053c62ce90c2c344d.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2368 2276 72387b030f7c483053c62ce90c2c344d.exe 28 PID 2276 wrote to memory of 2368 2276 72387b030f7c483053c62ce90c2c344d.exe 28 PID 2276 wrote to memory of 2368 2276 72387b030f7c483053c62ce90c2c344d.exe 28 PID 2276 wrote to memory of 2368 2276 72387b030f7c483053c62ce90c2c344d.exe 28 PID 2368 wrote to memory of 2388 2368 cmd.exe 30 PID 2368 wrote to memory of 2388 2368 cmd.exe 30 PID 2368 wrote to memory of 2388 2368 cmd.exe 30 PID 2368 wrote to memory of 2388 2368 cmd.exe 30 PID 2368 wrote to memory of 3068 2368 cmd.exe 31 PID 2368 wrote to memory of 3068 2368 cmd.exe 31 PID 2368 wrote to memory of 3068 2368 cmd.exe 31 PID 2368 wrote to memory of 3068 2368 cmd.exe 31 PID 2368 wrote to memory of 2712 2368 cmd.exe 32 PID 2368 wrote to memory of 2712 2368 cmd.exe 32 PID 2368 wrote to memory of 2712 2368 cmd.exe 32 PID 2368 wrote to memory of 2712 2368 cmd.exe 32 PID 2368 wrote to memory of 2428 2368 cmd.exe 34 PID 2368 wrote to memory of 2428 2368 cmd.exe 34 PID 2368 wrote to memory of 2428 2368 cmd.exe 34 PID 2368 wrote to memory of 2428 2368 cmd.exe 34 PID 2428 wrote to memory of 2828 2428 net.exe 35 PID 2428 wrote to memory of 2828 2428 net.exe 35 PID 2428 wrote to memory of 2828 2428 net.exe 35 PID 2428 wrote to memory of 2828 2428 net.exe 35 PID 2368 wrote to memory of 2844 2368 cmd.exe 36 PID 2368 wrote to memory of 2844 2368 cmd.exe 36 PID 2368 wrote to memory of 2844 2368 cmd.exe 36 PID 2368 wrote to memory of 2844 2368 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\72387b030f7c483053c62ce90c2c344d.exe"C:\Users\Admin\AppData\Local\Temp\72387b030f7c483053c62ce90c2c344d.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2388
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3068
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2828
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5df71f6cfd9965b1f27d3ed90b7b6053b
SHA1d8344ec961b1fdfc53692edb91f50cc9a39abb33
SHA2567ac866e5f2b3e426525a30ec84072ac1ea54144fdb67cc1df62b4603744c400d
SHA5122f9742f4d0e4831f34e850574fa7f48e376b23622c4609f47fc4898702447b19af8c509e593a573a65783f0118087c271009c32906ccc810b3cc840615475196