Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
7f01121965b997f69eda48bbbfbd0092.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f01121965b997f69eda48bbbfbd0092.exe
Resource
win10v2004-20231215-en
General
-
Target
7f01121965b997f69eda48bbbfbd0092.exe
-
Size
24KB
-
MD5
7f01121965b997f69eda48bbbfbd0092
-
SHA1
fd059dc8ef60657063c0cb0eb01444c5e028b779
-
SHA256
eeef9bf4f1a02b52a39aa2d160040a6dda28983c66377dab6e69a6b390be7f43
-
SHA512
0f9e691c7a39965d7ac8e8c4fbbc9a1303e0f9b1cea86292babeb532665e9811472b8e3cca76e4656eaece723e3be192391eae597f21573a3a0dda60688501f1
-
SSDEEP
384:E3eVES+/xwGkRKJYklM61qmTTMVF9/q5A0:bGS+ZfbJYkO8qYoA5
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 7f01121965b997f69eda48bbbfbd0092.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 7f01121965b997f69eda48bbbfbd0092.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2536 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2388 ipconfig.exe 2712 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2536 tasklist.exe Token: SeDebugPrivilege 2712 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2364 7f01121965b997f69eda48bbbfbd0092.exe 2364 7f01121965b997f69eda48bbbfbd0092.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1036 2364 7f01121965b997f69eda48bbbfbd0092.exe 29 PID 2364 wrote to memory of 1036 2364 7f01121965b997f69eda48bbbfbd0092.exe 29 PID 2364 wrote to memory of 1036 2364 7f01121965b997f69eda48bbbfbd0092.exe 29 PID 2364 wrote to memory of 1036 2364 7f01121965b997f69eda48bbbfbd0092.exe 29 PID 1036 wrote to memory of 1964 1036 cmd.exe 31 PID 1036 wrote to memory of 1964 1036 cmd.exe 31 PID 1036 wrote to memory of 1964 1036 cmd.exe 31 PID 1036 wrote to memory of 1964 1036 cmd.exe 31 PID 1036 wrote to memory of 2388 1036 cmd.exe 30 PID 1036 wrote to memory of 2388 1036 cmd.exe 30 PID 1036 wrote to memory of 2388 1036 cmd.exe 30 PID 1036 wrote to memory of 2388 1036 cmd.exe 30 PID 1036 wrote to memory of 2536 1036 cmd.exe 32 PID 1036 wrote to memory of 2536 1036 cmd.exe 32 PID 1036 wrote to memory of 2536 1036 cmd.exe 32 PID 1036 wrote to memory of 2536 1036 cmd.exe 32 PID 1036 wrote to memory of 2644 1036 cmd.exe 35 PID 1036 wrote to memory of 2644 1036 cmd.exe 35 PID 1036 wrote to memory of 2644 1036 cmd.exe 35 PID 1036 wrote to memory of 2644 1036 cmd.exe 35 PID 2644 wrote to memory of 2660 2644 net.exe 34 PID 2644 wrote to memory of 2660 2644 net.exe 34 PID 2644 wrote to memory of 2660 2644 net.exe 34 PID 2644 wrote to memory of 2660 2644 net.exe 34 PID 1036 wrote to memory of 2712 1036 cmd.exe 36 PID 1036 wrote to memory of 2712 1036 cmd.exe 36 PID 1036 wrote to memory of 2712 1036 cmd.exe 36 PID 1036 wrote to memory of 2712 1036 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f01121965b997f69eda48bbbfbd0092.exe"C:\Users\Admin\AppData\Local\Temp\7f01121965b997f69eda48bbbfbd0092.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2388
-
-
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1964
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2644
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start1⤵PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b74ab44a9022a27eebf122a33cb79189
SHA12da846f3c3b60353dcb4de992fd135ec0b1f7877
SHA25631d6b42ef6a51b463c0749805afa1adfa3a4c7d9169f4c58b9135667fb2e3150
SHA5129edfd9bba7f2d63e31be0b2213c9016910ad2bf89773c894f0bdbd4a198b98d4bd3033ca70e6425af6a8aa9111a18d5c797c299dccdd674621aa5f8b98040483