Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
a0b352c83af0acd62f6f869e689c4ea7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0b352c83af0acd62f6f869e689c4ea7.exe
Resource
win10v2004-20240221-en
General
-
Target
a0b352c83af0acd62f6f869e689c4ea7.exe
-
Size
24KB
-
MD5
a0b352c83af0acd62f6f869e689c4ea7
-
SHA1
e2a5645f2e368332bf129c1a7c3372feef65ff5b
-
SHA256
906e2b6f50b5b228174f20b45e614b80606589de602c1e2b49e0311ed73396c9
-
SHA512
c5ec97e3396d4b9fed2ce6b55a7ceae3dd50bc2bc492efcc2d780187d6e323a852ada0de75b465368447b3c8c14031a412cc91512a9abe3a76a8eb091f8a386b
-
SSDEEP
384:E3eVES+/xwGkRKJ3cZlM61qmTTMVF9/q5e80:bGS+ZfbJMZO8qYoAet
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" a0b352c83af0acd62f6f869e689c4ea7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe a0b352c83af0acd62f6f869e689c4ea7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1880 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2028 ipconfig.exe 2628 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1880 tasklist.exe Token: SeDebugPrivilege 2628 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1740 a0b352c83af0acd62f6f869e689c4ea7.exe 1740 a0b352c83af0acd62f6f869e689c4ea7.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1940 1740 a0b352c83af0acd62f6f869e689c4ea7.exe 28 PID 1740 wrote to memory of 1940 1740 a0b352c83af0acd62f6f869e689c4ea7.exe 28 PID 1740 wrote to memory of 1940 1740 a0b352c83af0acd62f6f869e689c4ea7.exe 28 PID 1740 wrote to memory of 1940 1740 a0b352c83af0acd62f6f869e689c4ea7.exe 28 PID 1940 wrote to memory of 2224 1940 cmd.exe 30 PID 1940 wrote to memory of 2224 1940 cmd.exe 30 PID 1940 wrote to memory of 2224 1940 cmd.exe 30 PID 1940 wrote to memory of 2224 1940 cmd.exe 30 PID 1940 wrote to memory of 2028 1940 cmd.exe 31 PID 1940 wrote to memory of 2028 1940 cmd.exe 31 PID 1940 wrote to memory of 2028 1940 cmd.exe 31 PID 1940 wrote to memory of 2028 1940 cmd.exe 31 PID 1940 wrote to memory of 1880 1940 cmd.exe 32 PID 1940 wrote to memory of 1880 1940 cmd.exe 32 PID 1940 wrote to memory of 1880 1940 cmd.exe 32 PID 1940 wrote to memory of 1880 1940 cmd.exe 32 PID 1940 wrote to memory of 2640 1940 cmd.exe 34 PID 1940 wrote to memory of 2640 1940 cmd.exe 34 PID 1940 wrote to memory of 2640 1940 cmd.exe 34 PID 1940 wrote to memory of 2640 1940 cmd.exe 34 PID 2640 wrote to memory of 2660 2640 net.exe 35 PID 2640 wrote to memory of 2660 2640 net.exe 35 PID 2640 wrote to memory of 2660 2640 net.exe 35 PID 2640 wrote to memory of 2660 2640 net.exe 35 PID 1940 wrote to memory of 2628 1940 cmd.exe 36 PID 1940 wrote to memory of 2628 1940 cmd.exe 36 PID 1940 wrote to memory of 2628 1940 cmd.exe 36 PID 1940 wrote to memory of 2628 1940 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2224
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2028
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2660
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD520a619db8ec349f9675dd3dac3781171
SHA15549d1bb5b1ea0e0bc433940a823ada02a4e1a6f
SHA2564d2f92be1db4e1b91cb5cd8bf2ee3594072d7e94432d98def534c3a3ae1f40e5
SHA51221426d185bbaa6b03393b82526e2f6d25be8ed632316e79d67cec777da9ab96c78b02d713a215a9a35bd18cb203d9b606d4fa9dc0d18035a2af6fcba45eb478a