Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
d605e4ef9ce7091efa462185a7691b89.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d605e4ef9ce7091efa462185a7691b89.exe
Resource
win10v2004-20240226-en
General
-
Target
d605e4ef9ce7091efa462185a7691b89.exe
-
Size
24KB
-
MD5
d605e4ef9ce7091efa462185a7691b89
-
SHA1
5e5866fe440d4332d7e5cb7910790f42d196d6a7
-
SHA256
d7404c46de658fbc070d295a4363e381f71143967231101bb12310a14af13047
-
SHA512
bbd7cd6b2c54228c7201a609f383e2dcd5ea689d5a217243d35bd43f4e7bff379a74eefea4b179e22e2b0c40500f5f00940b4c12fae59e07e01655ac8de3068e
-
SSDEEP
384:E3eVES+/xwGkRKJolM61qmTTMVF9/q540:bGS+ZfbJoO8qYoAB
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" d605e4ef9ce7091efa462185a7691b89.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe d605e4ef9ce7091efa462185a7691b89.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3952 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3312 ipconfig.exe 2196 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3952 tasklist.exe Token: SeDebugPrivilege 2196 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2808 d605e4ef9ce7091efa462185a7691b89.exe 2808 d605e4ef9ce7091efa462185a7691b89.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2868 2808 d605e4ef9ce7091efa462185a7691b89.exe 89 PID 2808 wrote to memory of 2868 2808 d605e4ef9ce7091efa462185a7691b89.exe 89 PID 2808 wrote to memory of 2868 2808 d605e4ef9ce7091efa462185a7691b89.exe 89 PID 2868 wrote to memory of 4596 2868 cmd.exe 91 PID 2868 wrote to memory of 4596 2868 cmd.exe 91 PID 2868 wrote to memory of 4596 2868 cmd.exe 91 PID 2868 wrote to memory of 3312 2868 cmd.exe 92 PID 2868 wrote to memory of 3312 2868 cmd.exe 92 PID 2868 wrote to memory of 3312 2868 cmd.exe 92 PID 2868 wrote to memory of 3952 2868 cmd.exe 93 PID 2868 wrote to memory of 3952 2868 cmd.exe 93 PID 2868 wrote to memory of 3952 2868 cmd.exe 93 PID 2868 wrote to memory of 2684 2868 cmd.exe 96 PID 2868 wrote to memory of 2684 2868 cmd.exe 96 PID 2868 wrote to memory of 2684 2868 cmd.exe 96 PID 2684 wrote to memory of 1728 2684 net.exe 97 PID 2684 wrote to memory of 1728 2684 net.exe 97 PID 2684 wrote to memory of 1728 2684 net.exe 97 PID 2868 wrote to memory of 2196 2868 cmd.exe 98 PID 2868 wrote to memory of 2196 2868 cmd.exe 98 PID 2868 wrote to memory of 2196 2868 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\d605e4ef9ce7091efa462185a7691b89.exe"C:\Users\Admin\AppData\Local\Temp\d605e4ef9ce7091efa462185a7691b89.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:4596
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3312
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1728
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5627c3ddc7cc6d7cb16ec70008063cc8c
SHA1836b674d5e84239f8b7fb809ae2a5dd529bf36d8
SHA256ba5b3130bcfa087916392d3d19c8f2f1fffc7c485073f5e3c96b6fcd7be39c33
SHA51242cd0186fa752af5234f7752cd91d41db78b824c333bad0ce9a0999b735a13094ee3bb3e10deca959d8e031af026c8056e66885a47ccbf3bd5a88d589519b56e