Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/04/2024, 04:47
240425-fezzdsfg4z 825/04/2024, 04:44
240425-fdbv6sfe82 725/04/2024, 04:30
240425-e42zlsfc57 825/04/2024, 04:26
240425-e2hg7afb98 825/04/2024, 04:23
240425-ez875afd3v 7Analysis
-
max time kernel
495s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 04:47
Static task
static1
1 signatures
General
-
Target
SpySheriff.exe
-
Size
403KB
-
MD5
c899f93e8b753fedd068ef3fe2edb0fd
-
SHA1
144b1f18d0e307d14937c21ca1d7cbfc91828a10
-
SHA256
5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47
-
SHA512
1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b
-
SSDEEP
12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD
Malware Config
Signatures
-
Modifies RDP port number used by Windows 1 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpySheriff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation SpySheriff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpySheriff = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpySheriff.exe" SpySheriff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpySheriff.exe -
Maps connected drives based on registry 3 TTPs 5 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance SpySheriff.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName SpySheriff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet SpySheriff.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier SpySheriff.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2168 SpySheriff.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2444 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2444 AUDIODG.EXE Token: 33 2444 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2444 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe 2168 SpySheriff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2168
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Modifies registry class
PID:2400
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5401⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD523e210e6c091cf6cab42572ab1e3dcfa
SHA1cc4464f186a9985274f8697a38ff241275054fe3
SHA2560f5fa1672dcdf709bc72675747327a9e116a23555006c8181550a99f17fa987c
SHA51248f90cd6d09d3e50e4aa08501e64880e5f0d5b197868a28e9bec1416a11a39f33350dccf121fce6dda980c529c4e6caea69bd20688978aba93035ffd1b70d9b2