Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
d605e4ef9ce7091efa462185a7691b89.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d605e4ef9ce7091efa462185a7691b89.exe
Resource
win10v2004-20240226-en
General
-
Target
d605e4ef9ce7091efa462185a7691b89.exe
-
Size
24KB
-
MD5
d605e4ef9ce7091efa462185a7691b89
-
SHA1
5e5866fe440d4332d7e5cb7910790f42d196d6a7
-
SHA256
d7404c46de658fbc070d295a4363e381f71143967231101bb12310a14af13047
-
SHA512
bbd7cd6b2c54228c7201a609f383e2dcd5ea689d5a217243d35bd43f4e7bff379a74eefea4b179e22e2b0c40500f5f00940b4c12fae59e07e01655ac8de3068e
-
SSDEEP
384:E3eVES+/xwGkRKJolM61qmTTMVF9/q540:bGS+ZfbJoO8qYoAB
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" d605e4ef9ce7091efa462185a7691b89.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe d605e4ef9ce7091efa462185a7691b89.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2172 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2820 ipconfig.exe 2660 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 tasklist.exe Token: SeDebugPrivilege 2660 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2240 d605e4ef9ce7091efa462185a7691b89.exe 2240 d605e4ef9ce7091efa462185a7691b89.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2544 2240 d605e4ef9ce7091efa462185a7691b89.exe 28 PID 2240 wrote to memory of 2544 2240 d605e4ef9ce7091efa462185a7691b89.exe 28 PID 2240 wrote to memory of 2544 2240 d605e4ef9ce7091efa462185a7691b89.exe 28 PID 2240 wrote to memory of 2544 2240 d605e4ef9ce7091efa462185a7691b89.exe 28 PID 2544 wrote to memory of 2816 2544 cmd.exe 30 PID 2544 wrote to memory of 2816 2544 cmd.exe 30 PID 2544 wrote to memory of 2816 2544 cmd.exe 30 PID 2544 wrote to memory of 2816 2544 cmd.exe 30 PID 2544 wrote to memory of 2820 2544 cmd.exe 31 PID 2544 wrote to memory of 2820 2544 cmd.exe 31 PID 2544 wrote to memory of 2820 2544 cmd.exe 31 PID 2544 wrote to memory of 2820 2544 cmd.exe 31 PID 2544 wrote to memory of 2172 2544 cmd.exe 32 PID 2544 wrote to memory of 2172 2544 cmd.exe 32 PID 2544 wrote to memory of 2172 2544 cmd.exe 32 PID 2544 wrote to memory of 2172 2544 cmd.exe 32 PID 2544 wrote to memory of 2676 2544 cmd.exe 34 PID 2544 wrote to memory of 2676 2544 cmd.exe 34 PID 2544 wrote to memory of 2676 2544 cmd.exe 34 PID 2544 wrote to memory of 2676 2544 cmd.exe 34 PID 2676 wrote to memory of 2724 2676 net.exe 35 PID 2676 wrote to memory of 2724 2676 net.exe 35 PID 2676 wrote to memory of 2724 2676 net.exe 35 PID 2676 wrote to memory of 2724 2676 net.exe 35 PID 2544 wrote to memory of 2660 2544 cmd.exe 36 PID 2544 wrote to memory of 2660 2544 cmd.exe 36 PID 2544 wrote to memory of 2660 2544 cmd.exe 36 PID 2544 wrote to memory of 2660 2544 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\d605e4ef9ce7091efa462185a7691b89.exe"C:\Users\Admin\AppData\Local\Temp\d605e4ef9ce7091efa462185a7691b89.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2816
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2820
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2724
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD522f07d313a3fc232a13acb42ad9e5385
SHA11fa957427df5b04eb9f78d7185cb8202333aae3b
SHA256db9ebbe23a6273eeeb72e8d63673130092301fa81297bedda0873d1a19b33ddf
SHA512d79fd573f6d7d44670f34faf528e482cc07e89e1d0b90b2d1bbc1c9e29b1e2e970b09bac236b2c26d83d1f1bf53d654cf4a65b3c591ca1faed1c74598ea2b97e