Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
a0b352c83af0acd62f6f869e689c4ea7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a0b352c83af0acd62f6f869e689c4ea7.exe
Resource
win10v2004-20240221-en
General
-
Target
a0b352c83af0acd62f6f869e689c4ea7.exe
-
Size
24KB
-
MD5
a0b352c83af0acd62f6f869e689c4ea7
-
SHA1
e2a5645f2e368332bf129c1a7c3372feef65ff5b
-
SHA256
906e2b6f50b5b228174f20b45e614b80606589de602c1e2b49e0311ed73396c9
-
SHA512
c5ec97e3396d4b9fed2ce6b55a7ceae3dd50bc2bc492efcc2d780187d6e323a852ada0de75b465368447b3c8c14031a412cc91512a9abe3a76a8eb091f8a386b
-
SSDEEP
384:E3eVES+/xwGkRKJ3cZlM61qmTTMVF9/q5e80:bGS+ZfbJMZO8qYoAet
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" a0b352c83af0acd62f6f869e689c4ea7.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe a0b352c83af0acd62f6f869e689c4ea7.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2008 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3480 NETSTAT.EXE 4568 ipconfig.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2008 tasklist.exe Token: SeDebugPrivilege 3480 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1492 a0b352c83af0acd62f6f869e689c4ea7.exe 1492 a0b352c83af0acd62f6f869e689c4ea7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1492 wrote to memory of 820 1492 a0b352c83af0acd62f6f869e689c4ea7.exe 86 PID 1492 wrote to memory of 820 1492 a0b352c83af0acd62f6f869e689c4ea7.exe 86 PID 1492 wrote to memory of 820 1492 a0b352c83af0acd62f6f869e689c4ea7.exe 86 PID 820 wrote to memory of 4944 820 cmd.exe 88 PID 820 wrote to memory of 4944 820 cmd.exe 88 PID 820 wrote to memory of 4944 820 cmd.exe 88 PID 820 wrote to memory of 4568 820 cmd.exe 89 PID 820 wrote to memory of 4568 820 cmd.exe 89 PID 820 wrote to memory of 4568 820 cmd.exe 89 PID 820 wrote to memory of 2008 820 cmd.exe 90 PID 820 wrote to memory of 2008 820 cmd.exe 90 PID 820 wrote to memory of 2008 820 cmd.exe 90 PID 820 wrote to memory of 4656 820 cmd.exe 94 PID 820 wrote to memory of 4656 820 cmd.exe 94 PID 820 wrote to memory of 4656 820 cmd.exe 94 PID 4656 wrote to memory of 4380 4656 net.exe 95 PID 4656 wrote to memory of 4380 4656 net.exe 95 PID 4656 wrote to memory of 4380 4656 net.exe 95 PID 820 wrote to memory of 3480 820 cmd.exe 96 PID 820 wrote to memory of 3480 820 cmd.exe 96 PID 820 wrote to memory of 3480 820 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:4944
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4568
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4380
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5b7f87aab159abb5a36a5d6f8f5bea1a8
SHA1ae71f2e770a974e931c1de6d9a6512c63658a8d5
SHA256cdf6b79f5553366a863f0f4e830cffbab6bd2aa5aed199185216d69a0406c22c
SHA51208f9c7b09fcb43fbbd40a70e7413f633fc4076117e23e7e511d698f19302e739534be9007cf8c0026f7a03a2b63483a211b6fa37100e371f3a6bf608f063d12a