Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
7d854951175d8637823c1b8b387892c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7d854951175d8637823c1b8b387892c7.exe
Resource
win10v2004-20231215-en
General
-
Target
7d854951175d8637823c1b8b387892c7.exe
-
Size
24KB
-
MD5
7d854951175d8637823c1b8b387892c7
-
SHA1
7b5a0c9602d9cba5069b50bd522bb8daa93764b0
-
SHA256
0e84b0c0200052fddc5165c693496a5c03282b3ff32d83679e4f6488db38664c
-
SHA512
18d76c2e32cf93c231c9806c90ed69a3e5db99bb183a55531fa6122a5abc061aba3aa4542f5fc3264117f6e5bfa9544cad5a0148f5986980282deca0d4ea314a
-
SSDEEP
384:E3eVES+/xwGkRKJG1ukM5lM61qmTTMVF9/q5hc0:bGS+ZfbJP5O8qYoAn
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 7d854951175d8637823c1b8b387892c7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 7d854951175d8637823c1b8b387892c7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2832 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2036 ipconfig.exe 2928 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2832 tasklist.exe Token: SeDebugPrivilege 2928 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1088 7d854951175d8637823c1b8b387892c7.exe 1088 7d854951175d8637823c1b8b387892c7.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2896 1088 7d854951175d8637823c1b8b387892c7.exe 28 PID 1088 wrote to memory of 2896 1088 7d854951175d8637823c1b8b387892c7.exe 28 PID 1088 wrote to memory of 2896 1088 7d854951175d8637823c1b8b387892c7.exe 28 PID 1088 wrote to memory of 2896 1088 7d854951175d8637823c1b8b387892c7.exe 28 PID 2896 wrote to memory of 2052 2896 cmd.exe 30 PID 2896 wrote to memory of 2052 2896 cmd.exe 30 PID 2896 wrote to memory of 2052 2896 cmd.exe 30 PID 2896 wrote to memory of 2052 2896 cmd.exe 30 PID 2896 wrote to memory of 2036 2896 cmd.exe 31 PID 2896 wrote to memory of 2036 2896 cmd.exe 31 PID 2896 wrote to memory of 2036 2896 cmd.exe 31 PID 2896 wrote to memory of 2036 2896 cmd.exe 31 PID 2896 wrote to memory of 2832 2896 cmd.exe 32 PID 2896 wrote to memory of 2832 2896 cmd.exe 32 PID 2896 wrote to memory of 2832 2896 cmd.exe 32 PID 2896 wrote to memory of 2832 2896 cmd.exe 32 PID 2896 wrote to memory of 2736 2896 cmd.exe 34 PID 2896 wrote to memory of 2736 2896 cmd.exe 34 PID 2896 wrote to memory of 2736 2896 cmd.exe 34 PID 2896 wrote to memory of 2736 2896 cmd.exe 34 PID 2736 wrote to memory of 2892 2736 net.exe 35 PID 2736 wrote to memory of 2892 2736 net.exe 35 PID 2736 wrote to memory of 2892 2736 net.exe 35 PID 2736 wrote to memory of 2892 2736 net.exe 35 PID 2896 wrote to memory of 2928 2896 cmd.exe 36 PID 2896 wrote to memory of 2928 2896 cmd.exe 36 PID 2896 wrote to memory of 2928 2896 cmd.exe 36 PID 2896 wrote to memory of 2928 2896 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d854951175d8637823c1b8b387892c7.exe"C:\Users\Admin\AppData\Local\Temp\7d854951175d8637823c1b8b387892c7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2052
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2036
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2892
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b8105d5ab433f7613cd3a05bf8aa829a
SHA10e9e0097e71d5bc8c435933fa02d898ed292e2e5
SHA256c302986a5e03945e09a21c19f2b6a3f92d001c8dd8d530569b44f9ff1d72c26c
SHA512b5be1166c54a03dfe8ca9aedb033758ec8f586ac77df413c8239de604583643f2ccaa1942268b7df253b46c139200970911c97cd7f2f20e66e9b1a20246bdbea