Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
980b0a5a2e1928152808095ff28cf618.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
980b0a5a2e1928152808095ff28cf618.exe
Resource
win10v2004-20231222-en
General
-
Target
980b0a5a2e1928152808095ff28cf618.exe
-
Size
24KB
-
MD5
980b0a5a2e1928152808095ff28cf618
-
SHA1
d12903e7421d5b7d5f1621af45e201b6a1b004f5
-
SHA256
5ccfc8bd24542e624bcda0a41fcf9f4071fe3af15d8132accbfd32623dde168c
-
SHA512
00984ed57ae6553fbe52ae1b1a6a055d0ece3ccc6b77fae513afd76241ea3fd6701f52d34fdec190ca4917c4d4010da2033465e6ccf376722a4df545d14ab904
-
SSDEEP
384:E3eVES+/xwGkRKJlXlM61qmTTMVF9/q5Mv0:bGS+ZfbJJO8qYoAX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 980b0a5a2e1928152808095ff28cf618.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 980b0a5a2e1928152808095ff28cf618.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2396 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2088 NETSTAT.EXE 2912 ipconfig.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2396 tasklist.exe Token: SeDebugPrivilege 2088 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2248 980b0a5a2e1928152808095ff28cf618.exe 2248 980b0a5a2e1928152808095ff28cf618.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2328 2248 980b0a5a2e1928152808095ff28cf618.exe 28 PID 2248 wrote to memory of 2328 2248 980b0a5a2e1928152808095ff28cf618.exe 28 PID 2248 wrote to memory of 2328 2248 980b0a5a2e1928152808095ff28cf618.exe 28 PID 2248 wrote to memory of 2328 2248 980b0a5a2e1928152808095ff28cf618.exe 28 PID 2328 wrote to memory of 2536 2328 cmd.exe 30 PID 2328 wrote to memory of 2536 2328 cmd.exe 30 PID 2328 wrote to memory of 2536 2328 cmd.exe 30 PID 2328 wrote to memory of 2536 2328 cmd.exe 30 PID 2328 wrote to memory of 2912 2328 cmd.exe 31 PID 2328 wrote to memory of 2912 2328 cmd.exe 31 PID 2328 wrote to memory of 2912 2328 cmd.exe 31 PID 2328 wrote to memory of 2912 2328 cmd.exe 31 PID 2328 wrote to memory of 2396 2328 cmd.exe 32 PID 2328 wrote to memory of 2396 2328 cmd.exe 32 PID 2328 wrote to memory of 2396 2328 cmd.exe 32 PID 2328 wrote to memory of 2396 2328 cmd.exe 32 PID 2328 wrote to memory of 2784 2328 cmd.exe 34 PID 2328 wrote to memory of 2784 2328 cmd.exe 34 PID 2328 wrote to memory of 2784 2328 cmd.exe 34 PID 2328 wrote to memory of 2784 2328 cmd.exe 34 PID 2784 wrote to memory of 2772 2784 net.exe 35 PID 2784 wrote to memory of 2772 2784 net.exe 35 PID 2784 wrote to memory of 2772 2784 net.exe 35 PID 2784 wrote to memory of 2772 2784 net.exe 35 PID 2328 wrote to memory of 2088 2328 cmd.exe 36 PID 2328 wrote to memory of 2088 2328 cmd.exe 36 PID 2328 wrote to memory of 2088 2328 cmd.exe 36 PID 2328 wrote to memory of 2088 2328 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\980b0a5a2e1928152808095ff28cf618.exe"C:\Users\Admin\AppData\Local\Temp\980b0a5a2e1928152808095ff28cf618.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2536
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2912
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2772
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD59f656f13471d4cd17a8204400885febb
SHA15c88327b59b7091fc961d1edc353682fa059526c
SHA256f163337c92dce3b37d3b077efaaace439bbd70aba4a4f4a26b2ee06a8cfd1388
SHA512771e467c96f263c2a03e7268495b40a35b5865ea2af8790016a9076f7c21ff127626c5e565e72dedb5375235330aea9be137493a12b3cdb4591dec799e872200