Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/04/2024, 04:47
240425-fezzdsfg4z 825/04/2024, 04:44
240425-fdbv6sfe82 725/04/2024, 04:30
240425-e42zlsfc57 825/04/2024, 04:26
240425-e2hg7afb98 825/04/2024, 04:23
240425-ez875afd3v 7Analysis
-
max time kernel
38s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
SpySheriff.exe
Resource
win10v2004-20240412-en
General
-
Target
SpySheriff.exe
-
Size
403KB
-
MD5
c899f93e8b753fedd068ef3fe2edb0fd
-
SHA1
144b1f18d0e307d14937c21ca1d7cbfc91828a10
-
SHA256
5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47
-
SHA512
1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b
-
SSDEEP
12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpySheriff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation SpySheriff.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpySheriff = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpySheriff.exe" SpySheriff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe -
Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe 4032 SpySheriff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4032
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:876
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:3296
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:2996
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:3592
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:5068
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:2360
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵PID:5028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a06021c8c04177492d29a58d8fda3c46
SHA18cbaff0cf54a622654b4da65b7257e7bbfef2803
SHA25628fe2ae9776215412130afe805ce58906577c0ff6f83b4c495e16f93db092fab
SHA512690968f3d0969b296c37ff68bfce10183939f0371108531cbe76e7b4e52590835ffa4bbd82f0f6271c92709d3978fbaab97ad1ce6f115a3c4d28bb3f020a611c