Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
8fa6705cafa0b85c86a0c262ad2710c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8fa6705cafa0b85c86a0c262ad2710c7.exe
Resource
win10v2004-20231215-en
General
-
Target
8fa6705cafa0b85c86a0c262ad2710c7.exe
-
Size
24KB
-
MD5
8fa6705cafa0b85c86a0c262ad2710c7
-
SHA1
db82ee15066dfdbe3f24c5afe3536cf3cdc216fb
-
SHA256
3526c8e772df5af10fd7ac5a467b1cfea71351949a3d082c94d02c11c8051675
-
SHA512
cba56394d1e525717f2183f8c4ddc630d552e409f9e60973717d9c5e0f4b760c64ab5646bb1f99cf5fcd50cfa96ad86116c30c3be01efc87d4175f815cc34f9b
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5e0:bGS+ZfbJiO8qYoAX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 8fa6705cafa0b85c86a0c262ad2710c7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 8fa6705cafa0b85c86a0c262ad2710c7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1524 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2156 ipconfig.exe 5104 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1524 tasklist.exe Token: SeDebugPrivilege 5104 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1768 8fa6705cafa0b85c86a0c262ad2710c7.exe 1768 8fa6705cafa0b85c86a0c262ad2710c7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1768 wrote to memory of 3412 1768 8fa6705cafa0b85c86a0c262ad2710c7.exe 84 PID 1768 wrote to memory of 3412 1768 8fa6705cafa0b85c86a0c262ad2710c7.exe 84 PID 1768 wrote to memory of 3412 1768 8fa6705cafa0b85c86a0c262ad2710c7.exe 84 PID 3412 wrote to memory of 992 3412 cmd.exe 86 PID 3412 wrote to memory of 992 3412 cmd.exe 86 PID 3412 wrote to memory of 992 3412 cmd.exe 86 PID 3412 wrote to memory of 2156 3412 cmd.exe 87 PID 3412 wrote to memory of 2156 3412 cmd.exe 87 PID 3412 wrote to memory of 2156 3412 cmd.exe 87 PID 3412 wrote to memory of 1524 3412 cmd.exe 88 PID 3412 wrote to memory of 1524 3412 cmd.exe 88 PID 3412 wrote to memory of 1524 3412 cmd.exe 88 PID 3412 wrote to memory of 1860 3412 cmd.exe 90 PID 3412 wrote to memory of 1860 3412 cmd.exe 90 PID 3412 wrote to memory of 1860 3412 cmd.exe 90 PID 1860 wrote to memory of 2588 1860 net.exe 91 PID 1860 wrote to memory of 2588 1860 net.exe 91 PID 1860 wrote to memory of 2588 1860 net.exe 91 PID 3412 wrote to memory of 5104 3412 cmd.exe 92 PID 3412 wrote to memory of 5104 3412 cmd.exe 92 PID 3412 wrote to memory of 5104 3412 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa6705cafa0b85c86a0c262ad2710c7.exe"C:\Users\Admin\AppData\Local\Temp\8fa6705cafa0b85c86a0c262ad2710c7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:992
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2156
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2588
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD520810cc461e9716da6323b7468662890
SHA1bf8143fa6e30449439e2adf6b710dddc3f591093
SHA256a26d6d3f33a32a1b86861a2668a96aa0a9baaffd88c61773e048418fe78b2885
SHA512b3ae16a171fb7789032619cbf2936074d02dbc0ed68c8e199cc2317b163f46c1b0661ff13cb82e75a014c1ffa78e7c1fecc8d9ae0338f84da47f65b2a67086ea