Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
7d854951175d8637823c1b8b387892c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7d854951175d8637823c1b8b387892c7.exe
Resource
win10v2004-20231215-en
General
-
Target
7d854951175d8637823c1b8b387892c7.exe
-
Size
24KB
-
MD5
7d854951175d8637823c1b8b387892c7
-
SHA1
7b5a0c9602d9cba5069b50bd522bb8daa93764b0
-
SHA256
0e84b0c0200052fddc5165c693496a5c03282b3ff32d83679e4f6488db38664c
-
SHA512
18d76c2e32cf93c231c9806c90ed69a3e5db99bb183a55531fa6122a5abc061aba3aa4542f5fc3264117f6e5bfa9544cad5a0148f5986980282deca0d4ea314a
-
SSDEEP
384:E3eVES+/xwGkRKJG1ukM5lM61qmTTMVF9/q5hc0:bGS+ZfbJP5O8qYoAn
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 7d854951175d8637823c1b8b387892c7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 7d854951175d8637823c1b8b387892c7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3456 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4472 ipconfig.exe 224 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3456 tasklist.exe Token: SeDebugPrivilege 224 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4204 7d854951175d8637823c1b8b387892c7.exe 4204 7d854951175d8637823c1b8b387892c7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4204 wrote to memory of 1776 4204 7d854951175d8637823c1b8b387892c7.exe 84 PID 4204 wrote to memory of 1776 4204 7d854951175d8637823c1b8b387892c7.exe 84 PID 4204 wrote to memory of 1776 4204 7d854951175d8637823c1b8b387892c7.exe 84 PID 1776 wrote to memory of 4120 1776 cmd.exe 86 PID 1776 wrote to memory of 4120 1776 cmd.exe 86 PID 1776 wrote to memory of 4120 1776 cmd.exe 86 PID 1776 wrote to memory of 4472 1776 cmd.exe 87 PID 1776 wrote to memory of 4472 1776 cmd.exe 87 PID 1776 wrote to memory of 4472 1776 cmd.exe 87 PID 1776 wrote to memory of 3456 1776 cmd.exe 88 PID 1776 wrote to memory of 3456 1776 cmd.exe 88 PID 1776 wrote to memory of 3456 1776 cmd.exe 88 PID 1776 wrote to memory of 1980 1776 cmd.exe 90 PID 1776 wrote to memory of 1980 1776 cmd.exe 90 PID 1776 wrote to memory of 1980 1776 cmd.exe 90 PID 1980 wrote to memory of 1848 1980 net.exe 91 PID 1980 wrote to memory of 1848 1980 net.exe 91 PID 1980 wrote to memory of 1848 1980 net.exe 91 PID 1776 wrote to memory of 224 1776 cmd.exe 92 PID 1776 wrote to memory of 224 1776 cmd.exe 92 PID 1776 wrote to memory of 224 1776 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d854951175d8637823c1b8b387892c7.exe"C:\Users\Admin\AppData\Local\Temp\7d854951175d8637823c1b8b387892c7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:4120
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4472
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1848
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD54d62d8cd956721c4236abb8c41082988
SHA13cd8a81a4f99e5a309242e88b2abbb81567bc477
SHA2567a7f9a1301abf0a41e830794a53ea86938aa7c8662d818bb67e59e76681bccfa
SHA51222c9e29eecc64b5fcaa4252bedbc6dd2f84911a18c593fe7f47a2a56f64fb8d50b3ce82bd70f9b84a75be5b35d40fe4a968403bdb6f414353c284ca893b492e9