Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3ggpermV3.rar
windows7-x64
3ggpermV3.rar
windows10-2004-x64
7ggpermV3/A...64.exe
windows7-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows7-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows7-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows7-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows7-x64
ggpermV3/T...er.exe
windows10-2004-x64
ggpermV3/a...64.sys
windows7-x64
1ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows7-x64
1ggpermV3/ggpermV3.exe
windows10-2004-x64
1ggpermV3/m...er.bat
windows7-x64
1ggpermV3/m...er.bat
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.pdb
windows7-x64
3ggpermV3/s...er.pdb
windows10-2004-x64
3ggpermV3/s...g.json
windows7-x64
3ggpermV3/s...g.json
windows10-2004-x64
3ggpermV3/woof.bat
windows7-x64
8ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09/11/2024, 22:49
241109-2r2veatfrl 1009/11/2024, 22:47
241109-2qkjqssrdz 1009/11/2024, 22:46
241109-2p2fvstfqj 1009/11/2024, 22:44
241109-2nsgkasrbt 1007/11/2024, 16:00
241107-tfl1taxpgl 1010/02/2024, 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
4s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/02/2024, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
ggpermV3.rar
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
ggpermV3.rar
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ggpermV3/Final_Cleaner.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ggpermV3/Siticone.UI.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ggpermV3/amifldrv64.sys
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ggpermV3/ggpermV3.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ggpermV3/macchanger.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ggpermV3/sxghr-driver.pdb
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
ggpermV3/sxghr-driver.pdb
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ggpermV3/woof.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral28
Sample
ggpermV3/woof.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
ggpermV3/macchanger.bat
-
Size
2KB
-
MD5
c0b8d81370dd4defc9317dc6c204d581
-
SHA1
fa2b6a292c398d2a2febbdddcf39a62ffbb6fb23
-
SHA256
4d8d40a7e435fc815d088d7309a6bece3a9d798b4fb8170ca3d9c4c7c8c6784f
-
SHA512
271552179a651414d8b321017a8675a1cd09ac83394cc014453d28f1837b60db657b1d75362af71d075b1f4e33ac5eedf6556a43709589a6159c4d0ef2d00828
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4220 WMIC.exe Token: SeSecurityPrivilege 4220 WMIC.exe Token: SeTakeOwnershipPrivilege 4220 WMIC.exe Token: SeLoadDriverPrivilege 4220 WMIC.exe Token: SeSystemProfilePrivilege 4220 WMIC.exe Token: SeSystemtimePrivilege 4220 WMIC.exe Token: SeProfSingleProcessPrivilege 4220 WMIC.exe Token: SeIncBasePriorityPrivilege 4220 WMIC.exe Token: SeCreatePagefilePrivilege 4220 WMIC.exe Token: SeBackupPrivilege 4220 WMIC.exe Token: SeRestorePrivilege 4220 WMIC.exe Token: SeShutdownPrivilege 4220 WMIC.exe Token: SeDebugPrivilege 4220 WMIC.exe Token: SeSystemEnvironmentPrivilege 4220 WMIC.exe Token: SeRemoteShutdownPrivilege 4220 WMIC.exe Token: SeUndockPrivilege 4220 WMIC.exe Token: SeManageVolumePrivilege 4220 WMIC.exe Token: 33 4220 WMIC.exe Token: 34 4220 WMIC.exe Token: 35 4220 WMIC.exe Token: 36 4220 WMIC.exe Token: SeIncreaseQuotaPrivilege 4220 WMIC.exe Token: SeSecurityPrivilege 4220 WMIC.exe Token: SeTakeOwnershipPrivilege 4220 WMIC.exe Token: SeLoadDriverPrivilege 4220 WMIC.exe Token: SeSystemProfilePrivilege 4220 WMIC.exe Token: SeSystemtimePrivilege 4220 WMIC.exe Token: SeProfSingleProcessPrivilege 4220 WMIC.exe Token: SeIncBasePriorityPrivilege 4220 WMIC.exe Token: SeCreatePagefilePrivilege 4220 WMIC.exe Token: SeBackupPrivilege 4220 WMIC.exe Token: SeRestorePrivilege 4220 WMIC.exe Token: SeShutdownPrivilege 4220 WMIC.exe Token: SeDebugPrivilege 4220 WMIC.exe Token: SeSystemEnvironmentPrivilege 4220 WMIC.exe Token: SeRemoteShutdownPrivilege 4220 WMIC.exe Token: SeUndockPrivilege 4220 WMIC.exe Token: SeManageVolumePrivilege 4220 WMIC.exe Token: 33 4220 WMIC.exe Token: 34 4220 WMIC.exe Token: 35 4220 WMIC.exe Token: 36 4220 WMIC.exe Token: SeIncreaseQuotaPrivilege 212 WMIC.exe Token: SeSecurityPrivilege 212 WMIC.exe Token: SeTakeOwnershipPrivilege 212 WMIC.exe Token: SeLoadDriverPrivilege 212 WMIC.exe Token: SeSystemProfilePrivilege 212 WMIC.exe Token: SeSystemtimePrivilege 212 WMIC.exe Token: SeProfSingleProcessPrivilege 212 WMIC.exe Token: SeIncBasePriorityPrivilege 212 WMIC.exe Token: SeCreatePagefilePrivilege 212 WMIC.exe Token: SeBackupPrivilege 212 WMIC.exe Token: SeRestorePrivilege 212 WMIC.exe Token: SeShutdownPrivilege 212 WMIC.exe Token: SeDebugPrivilege 212 WMIC.exe Token: SeSystemEnvironmentPrivilege 212 WMIC.exe Token: SeRemoteShutdownPrivilege 212 WMIC.exe Token: SeUndockPrivilege 212 WMIC.exe Token: SeManageVolumePrivilege 212 WMIC.exe Token: 33 212 WMIC.exe Token: 34 212 WMIC.exe Token: 35 212 WMIC.exe Token: 36 212 WMIC.exe Token: SeIncreaseQuotaPrivilege 212 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 4180 2912 cmd.exe 84 PID 2912 wrote to memory of 4180 2912 cmd.exe 84 PID 4180 wrote to memory of 4220 4180 cmd.exe 85 PID 4180 wrote to memory of 4220 4180 cmd.exe 85 PID 4180 wrote to memory of 3932 4180 cmd.exe 86 PID 4180 wrote to memory of 3932 4180 cmd.exe 86 PID 2912 wrote to memory of 3324 2912 cmd.exe 88 PID 2912 wrote to memory of 3324 2912 cmd.exe 88 PID 2912 wrote to memory of 1460 2912 cmd.exe 89 PID 2912 wrote to memory of 1460 2912 cmd.exe 89 PID 2912 wrote to memory of 4528 2912 cmd.exe 90 PID 2912 wrote to memory of 4528 2912 cmd.exe 90 PID 2912 wrote to memory of 5072 2912 cmd.exe 91 PID 2912 wrote to memory of 5072 2912 cmd.exe 91 PID 2912 wrote to memory of 3436 2912 cmd.exe 92 PID 2912 wrote to memory of 3436 2912 cmd.exe 92 PID 3436 wrote to memory of 212 3436 cmd.exe 93 PID 3436 wrote to memory of 212 3436 cmd.exe 93 PID 3436 wrote to memory of 2664 3436 cmd.exe 94 PID 3436 wrote to memory of 2664 3436 cmd.exe 94 PID 2912 wrote to memory of 544 2912 cmd.exe 95 PID 2912 wrote to memory of 544 2912 cmd.exe 95 PID 2912 wrote to memory of 3464 2912 cmd.exe 96 PID 2912 wrote to memory of 3464 2912 cmd.exe 96 PID 2912 wrote to memory of 2336 2912 cmd.exe 97 PID 2912 wrote to memory of 2336 2912 cmd.exe 97 PID 2912 wrote to memory of 1944 2912 cmd.exe 98 PID 2912 wrote to memory of 1944 2912 cmd.exe 98 PID 2912 wrote to memory of 4824 2912 cmd.exe 99 PID 2912 wrote to memory of 4824 2912 cmd.exe 99 PID 4824 wrote to memory of 3636 4824 cmd.exe 100 PID 4824 wrote to memory of 3636 4824 cmd.exe 100 PID 2912 wrote to memory of 4192 2912 cmd.exe 101 PID 2912 wrote to memory of 4192 2912 cmd.exe 101 PID 2912 wrote to memory of 4180 2912 cmd.exe 187 PID 2912 wrote to memory of 4180 2912 cmd.exe 187 PID 4180 wrote to memory of 4220 4180 cmd.exe 188 PID 4180 wrote to memory of 4220 4180 cmd.exe 188 PID 4180 wrote to memory of 3932 4180 cmd.exe 189 PID 4180 wrote to memory of 3932 4180 cmd.exe 189 PID 2912 wrote to memory of 3324 2912 cmd.exe 191 PID 2912 wrote to memory of 3324 2912 cmd.exe 191 PID 2912 wrote to memory of 1460 2912 cmd.exe 192 PID 2912 wrote to memory of 1460 2912 cmd.exe 192 PID 2912 wrote to memory of 4528 2912 cmd.exe 193 PID 2912 wrote to memory of 4528 2912 cmd.exe 193 PID 2912 wrote to memory of 5072 2912 cmd.exe 194 PID 2912 wrote to memory of 5072 2912 cmd.exe 194 PID 2912 wrote to memory of 3436 2912 cmd.exe 195 PID 2912 wrote to memory of 3436 2912 cmd.exe 195 PID 3436 wrote to memory of 212 3436 cmd.exe 196 PID 3436 wrote to memory of 212 3436 cmd.exe 196 PID 3436 wrote to memory of 2664 3436 cmd.exe 197 PID 3436 wrote to memory of 2664 3436 cmd.exe 197 PID 2912 wrote to memory of 544 2912 cmd.exe 198 PID 2912 wrote to memory of 544 2912 cmd.exe 198 PID 2912 wrote to memory of 3464 2912 cmd.exe 199 PID 2912 wrote to memory of 3464 2912 cmd.exe 199 PID 2912 wrote to memory of 2336 2912 cmd.exe 200 PID 2912 wrote to memory of 2336 2912 cmd.exe 200 PID 2912 wrote to memory of 1944 2912 cmd.exe 201 PID 2912 wrote to memory of 1944 2912 cmd.exe 201 PID 2912 wrote to memory of 4824 2912 cmd.exe 202 PID 2912 wrote to memory of 4824 2912 cmd.exe 202
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\macchanger.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:3932
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:3324
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:1460
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4528
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 321BD52C0FDF /f2⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2664
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:544
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:3464
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:2336
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:3636
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵PID:4192
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2576
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\macchanger.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵PID:4220
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:3932
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:3324
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:1460
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:4528
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 321BD52C0FDF /f2⤵PID:5072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid3⤵PID:212
-
-
C:\Windows\system32\findstr.exefindstr [0-9]3⤵PID:2664
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\012⤵PID:544
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012⤵PID:3464
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00012⤵PID:2336
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f2⤵PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"2⤵PID:4824
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv3⤵PID:3636
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable2⤵PID:4192
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2576