Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3ggpermV3.rar
windows7-x64
3ggpermV3.rar
windows10-2004-x64
7ggpermV3/A...64.exe
windows7-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows7-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows7-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows7-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows7-x64
ggpermV3/T...er.exe
windows10-2004-x64
ggpermV3/a...64.sys
windows7-x64
1ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows7-x64
1ggpermV3/ggpermV3.exe
windows10-2004-x64
1ggpermV3/m...er.bat
windows7-x64
1ggpermV3/m...er.bat
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.pdb
windows7-x64
3ggpermV3/s...er.pdb
windows10-2004-x64
3ggpermV3/s...g.json
windows7-x64
3ggpermV3/s...g.json
windows10-2004-x64
3ggpermV3/woof.bat
windows7-x64
8ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09/11/2024, 22:49
241109-2r2veatfrl 1009/11/2024, 22:47
241109-2qkjqssrdz 1009/11/2024, 22:46
241109-2p2fvstfqj 1009/11/2024, 22:44
241109-2nsgkasrbt 1007/11/2024, 16:00
241107-tfl1taxpgl 1010/02/2024, 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
120s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/02/2024, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
ggpermV3.rar
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
ggpermV3.rar
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ggpermV3/Final_Cleaner.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ggpermV3/Siticone.UI.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ggpermV3/amifldrv64.sys
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ggpermV3/ggpermV3.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ggpermV3/macchanger.bat
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ggpermV3/sxghr-driver.pdb
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
ggpermV3/sxghr-driver.pdb
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ggpermV3/woof.bat
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral28
Sample
ggpermV3/woof.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3660 sc.exe 5040 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4496 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 26 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe Token: SeLoadDriverPrivilege 2280 svchost.exe Token: SeSystemtimePrivilege 2280 svchost.exe Token: SeBackupPrivilege 2280 svchost.exe Token: SeRestorePrivilege 2280 svchost.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 svchost.exe Token: SeUndockPrivilege 2280 svchost.exe Token: SeManageVolumePrivilege 2280 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe Token: SeLoadDriverPrivilege 2280 svchost.exe Token: SeSystemtimePrivilege 2280 svchost.exe Token: SeBackupPrivilege 2280 svchost.exe Token: SeRestorePrivilege 2280 svchost.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 svchost.exe Token: SeUndockPrivilege 2280 svchost.exe Token: SeManageVolumePrivilege 2280 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe Token: SeLoadDriverPrivilege 2280 svchost.exe Token: SeSystemtimePrivilege 2280 svchost.exe Token: SeBackupPrivilege 2280 svchost.exe Token: SeRestorePrivilege 2280 svchost.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 svchost.exe Token: SeUndockPrivilege 2280 svchost.exe Token: SeManageVolumePrivilege 2280 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe Token: SeLoadDriverPrivilege 2280 svchost.exe Token: SeSystemtimePrivilege 2280 svchost.exe Token: SeBackupPrivilege 2280 svchost.exe Token: SeRestorePrivilege 2280 svchost.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 svchost.exe Token: SeUndockPrivilege 2280 svchost.exe Token: SeManageVolumePrivilege 2280 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe Token: SeLoadDriverPrivilege 2280 svchost.exe Token: SeSystemtimePrivilege 2280 svchost.exe Token: SeBackupPrivilege 2280 svchost.exe Token: SeRestorePrivilege 2280 svchost.exe Token: SeShutdownPrivilege 2280 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 svchost.exe Token: SeUndockPrivilege 2280 svchost.exe Token: SeManageVolumePrivilege 2280 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2280 svchost.exe Token: SeIncreaseQuotaPrivilege 2280 svchost.exe Token: SeSecurityPrivilege 2280 svchost.exe Token: SeTakeOwnershipPrivilege 2280 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 4048 2856 cmd.exe 86 PID 2856 wrote to memory of 4048 2856 cmd.exe 86 PID 2856 wrote to memory of 920 2856 cmd.exe 87 PID 2856 wrote to memory of 920 2856 cmd.exe 87 PID 2856 wrote to memory of 4040 2856 cmd.exe 88 PID 2856 wrote to memory of 4040 2856 cmd.exe 88 PID 2856 wrote to memory of 3128 2856 cmd.exe 89 PID 2856 wrote to memory of 3128 2856 cmd.exe 89 PID 2856 wrote to memory of 1700 2856 cmd.exe 90 PID 2856 wrote to memory of 1700 2856 cmd.exe 90 PID 2856 wrote to memory of 2464 2856 cmd.exe 91 PID 2856 wrote to memory of 2464 2856 cmd.exe 91 PID 2856 wrote to memory of 376 2856 cmd.exe 92 PID 2856 wrote to memory of 376 2856 cmd.exe 92 PID 2856 wrote to memory of 3896 2856 cmd.exe 93 PID 2856 wrote to memory of 3896 2856 cmd.exe 93 PID 2856 wrote to memory of 3136 2856 cmd.exe 94 PID 2856 wrote to memory of 3136 2856 cmd.exe 94 PID 2856 wrote to memory of 1872 2856 cmd.exe 95 PID 2856 wrote to memory of 1872 2856 cmd.exe 95 PID 2856 wrote to memory of 3364 2856 cmd.exe 96 PID 2856 wrote to memory of 3364 2856 cmd.exe 96 PID 2856 wrote to memory of 2452 2856 cmd.exe 97 PID 2856 wrote to memory of 2452 2856 cmd.exe 97 PID 2856 wrote to memory of 5044 2856 cmd.exe 98 PID 2856 wrote to memory of 5044 2856 cmd.exe 98 PID 2856 wrote to memory of 4772 2856 cmd.exe 99 PID 2856 wrote to memory of 4772 2856 cmd.exe 99 PID 2856 wrote to memory of 1396 2856 cmd.exe 100 PID 2856 wrote to memory of 1396 2856 cmd.exe 100 PID 2856 wrote to memory of 2056 2856 cmd.exe 101 PID 2856 wrote to memory of 2056 2856 cmd.exe 101 PID 2856 wrote to memory of 3928 2856 cmd.exe 102 PID 2856 wrote to memory of 3928 2856 cmd.exe 102 PID 2856 wrote to memory of 4512 2856 cmd.exe 103 PID 2856 wrote to memory of 4512 2856 cmd.exe 103 PID 2856 wrote to memory of 2720 2856 cmd.exe 104 PID 2856 wrote to memory of 2720 2856 cmd.exe 104 PID 2856 wrote to memory of 1912 2856 cmd.exe 105 PID 2856 wrote to memory of 1912 2856 cmd.exe 105 PID 2856 wrote to memory of 2640 2856 cmd.exe 106 PID 2856 wrote to memory of 2640 2856 cmd.exe 106 PID 2856 wrote to memory of 4916 2856 cmd.exe 107 PID 2856 wrote to memory of 4916 2856 cmd.exe 107 PID 2856 wrote to memory of 2008 2856 cmd.exe 108 PID 2856 wrote to memory of 2008 2856 cmd.exe 108 PID 2856 wrote to memory of 2980 2856 cmd.exe 109 PID 2856 wrote to memory of 2980 2856 cmd.exe 109 PID 2856 wrote to memory of 2060 2856 cmd.exe 110 PID 2856 wrote to memory of 2060 2856 cmd.exe 110 PID 2856 wrote to memory of 3864 2856 cmd.exe 111 PID 2856 wrote to memory of 3864 2856 cmd.exe 111 PID 2856 wrote to memory of 4636 2856 cmd.exe 112 PID 2856 wrote to memory of 4636 2856 cmd.exe 112 PID 4636 wrote to memory of 1356 4636 net.exe 113 PID 4636 wrote to memory of 1356 4636 net.exe 113 PID 2856 wrote to memory of 4872 2856 cmd.exe 114 PID 2856 wrote to memory of 4872 2856 cmd.exe 114 PID 4872 wrote to memory of 3456 4872 net.exe 115 PID 4872 wrote to memory of 3456 4872 net.exe 115 PID 2856 wrote to memory of 3660 2856 cmd.exe 117 PID 2856 wrote to memory of 3660 2856 cmd.exe 117 PID 2856 wrote to memory of 5040 2856 cmd.exe 118 PID 2856 wrote to memory of 5040 2856 cmd.exe 118
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 267061050530798222622⤵PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 5001231321578992292⤵PID:920
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 2276130610174866732⤵PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 158731562512259156662⤵PID:3128
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 6761980712901123812⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 310481440018336103242⤵PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 160442546818930129402⤵PID:376
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 5310265317488142612⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 25787182319609291672⤵PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 11416233601454349232⤵PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 23457104021907123352⤵PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 2518448152032171352⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 311681461315915231282⤵PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 259701624212537188142⤵PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 13712656922754274812⤵PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 19328322127685201552⤵PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 97562297411259241972⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 14607187305920230672⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 2137813989616128212⤵PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 23033322932907074802⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 223911746329163311402⤵PID:4916
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 10729537310629200462⤵PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 199051837286861772⤵PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 329836341435148012⤵PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 53081837330252320332⤵PID:3864
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:1356
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:3456
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:3660
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:5040
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:4496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2280