Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
772384bb079e5fa694985c4dc2e240eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
772384bb079e5fa694985c4dc2e240eb.exe
Resource
win10v2004-20231222-en
General
-
Target
772384bb079e5fa694985c4dc2e240eb.exe
-
Size
24KB
-
MD5
772384bb079e5fa694985c4dc2e240eb
-
SHA1
f11097f5179c92328ec078e87cd2f4643ff88fd7
-
SHA256
67d59a41b9e7e521e0d0925339f9956b7a2fef6f346f8db163917ba7284c2fc9
-
SHA512
162e393249f9da39ccbbd1c62dcbb43b2a783e8cd7f2b50b11644b63612b1a7d0e80b013536ea6182f8a66b01584e85c62f993f8884b83937569089a487adc14
-
SSDEEP
384:E3eVES+/xwGkRKJ3lM61qmTTMVF9/q5d0:bGS+ZfbJ3O8qYoAS
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 772384bb079e5fa694985c4dc2e240eb.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 772384bb079e5fa694985c4dc2e240eb.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2692 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2408 ipconfig.exe 2756 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2692 tasklist.exe Token: SeDebugPrivilege 2756 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1224 772384bb079e5fa694985c4dc2e240eb.exe 1224 772384bb079e5fa694985c4dc2e240eb.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2160 1224 772384bb079e5fa694985c4dc2e240eb.exe 28 PID 1224 wrote to memory of 2160 1224 772384bb079e5fa694985c4dc2e240eb.exe 28 PID 1224 wrote to memory of 2160 1224 772384bb079e5fa694985c4dc2e240eb.exe 28 PID 1224 wrote to memory of 2160 1224 772384bb079e5fa694985c4dc2e240eb.exe 28 PID 2160 wrote to memory of 2412 2160 cmd.exe 30 PID 2160 wrote to memory of 2412 2160 cmd.exe 30 PID 2160 wrote to memory of 2412 2160 cmd.exe 30 PID 2160 wrote to memory of 2412 2160 cmd.exe 30 PID 2160 wrote to memory of 2408 2160 cmd.exe 31 PID 2160 wrote to memory of 2408 2160 cmd.exe 31 PID 2160 wrote to memory of 2408 2160 cmd.exe 31 PID 2160 wrote to memory of 2408 2160 cmd.exe 31 PID 2160 wrote to memory of 2692 2160 cmd.exe 32 PID 2160 wrote to memory of 2692 2160 cmd.exe 32 PID 2160 wrote to memory of 2692 2160 cmd.exe 32 PID 2160 wrote to memory of 2692 2160 cmd.exe 32 PID 2160 wrote to memory of 2844 2160 cmd.exe 34 PID 2160 wrote to memory of 2844 2160 cmd.exe 34 PID 2160 wrote to memory of 2844 2160 cmd.exe 34 PID 2160 wrote to memory of 2844 2160 cmd.exe 34 PID 2844 wrote to memory of 2852 2844 net.exe 35 PID 2844 wrote to memory of 2852 2844 net.exe 35 PID 2844 wrote to memory of 2852 2844 net.exe 35 PID 2844 wrote to memory of 2852 2844 net.exe 35 PID 2160 wrote to memory of 2756 2160 cmd.exe 36 PID 2160 wrote to memory of 2756 2160 cmd.exe 36 PID 2160 wrote to memory of 2756 2160 cmd.exe 36 PID 2160 wrote to memory of 2756 2160 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\772384bb079e5fa694985c4dc2e240eb.exe"C:\Users\Admin\AppData\Local\Temp\772384bb079e5fa694985c4dc2e240eb.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2412
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2408
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2852
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD590161f3c1a7b8abfbc01b002a03aa009
SHA1ef4b0d2615aa6902c807c770e9b2b39a53f75228
SHA256ebe64db525b521f9f5f7244aa789dcbbafbe583625ed59bbe7f3971854816be6
SHA512bfdba58cf6b88731bf4fdfb481d10c47b26f0c621b084b3e0951f50cd86aaab64fefc294aed01321646f6d8223082ad661d93a243b3eb2503f7c02a383c57f66