Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3ggpermV3/A...64.exe
windows7-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows7-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows7-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows7-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows7-x64
ggpermV3/T...er.exe
windows10-2004-x64
10ggpermV3/a...64.sys
windows7-x64
1ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows7-x64
6ggpermV3/ggpermV3.exe
windows10-2004-x64
3ggpermV3/m...er.bat
windows7-x64
3ggpermV3/m...er.bat
windows10-2004-x64
3ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows7-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/woof.bat
windows7-x64
8ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09/11/2024, 22:49
241109-2r2veatfrl 1009/11/2024, 22:47
241109-2qkjqssrdz 1009/11/2024, 22:46
241109-2p2fvstfqj 1009/11/2024, 22:44
241109-2nsgkasrbt 1007/11/2024, 16:00
241107-tfl1taxpgl 1010/02/2024, 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ggpermV3/Final_Cleaner.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ggpermV3/Siticone.UI.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ggpermV3/amifldrv64.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ggpermV3/ggpermV3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ggpermV3/macchanger.bat
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ggpermV3/sxghr-driver.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ggpermV3/woof.bat
Resource
win7-20240903-en
windows7-x64
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4760 sc.exe 3220 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2908 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 26 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeBackupPrivilege 4664 svchost.exe Token: SeRestorePrivilege 4664 svchost.exe Token: SeShutdownPrivilege 4664 svchost.exe Token: SeSystemEnvironmentPrivilege 4664 svchost.exe Token: SeManageVolumePrivilege 4664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeSystemtimePrivilege 4664 svchost.exe Token: SeBackupPrivilege 4664 svchost.exe Token: SeRestorePrivilege 4664 svchost.exe Token: SeShutdownPrivilege 4664 svchost.exe Token: SeSystemEnvironmentPrivilege 4664 svchost.exe Token: SeUndockPrivilege 4664 svchost.exe Token: SeManageVolumePrivilege 4664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeSystemtimePrivilege 4664 svchost.exe Token: SeBackupPrivilege 4664 svchost.exe Token: SeRestorePrivilege 4664 svchost.exe Token: SeShutdownPrivilege 4664 svchost.exe Token: SeSystemEnvironmentPrivilege 4664 svchost.exe Token: SeUndockPrivilege 4664 svchost.exe Token: SeManageVolumePrivilege 4664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeSystemtimePrivilege 4664 svchost.exe Token: SeBackupPrivilege 4664 svchost.exe Token: SeRestorePrivilege 4664 svchost.exe Token: SeShutdownPrivilege 4664 svchost.exe Token: SeSystemEnvironmentPrivilege 4664 svchost.exe Token: SeUndockPrivilege 4664 svchost.exe Token: SeManageVolumePrivilege 4664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeSystemtimePrivilege 4664 svchost.exe Token: SeBackupPrivilege 4664 svchost.exe Token: SeRestorePrivilege 4664 svchost.exe Token: SeShutdownPrivilege 4664 svchost.exe Token: SeSystemEnvironmentPrivilege 4664 svchost.exe Token: SeUndockPrivilege 4664 svchost.exe Token: SeManageVolumePrivilege 4664 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4664 svchost.exe Token: SeIncreaseQuotaPrivilege 4664 svchost.exe Token: SeSecurityPrivilege 4664 svchost.exe Token: SeTakeOwnershipPrivilege 4664 svchost.exe Token: SeLoadDriverPrivilege 4664 svchost.exe Token: SeSystemtimePrivilege 4664 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 908 728 cmd.exe 84 PID 728 wrote to memory of 908 728 cmd.exe 84 PID 728 wrote to memory of 888 728 cmd.exe 85 PID 728 wrote to memory of 888 728 cmd.exe 85 PID 728 wrote to memory of 2108 728 cmd.exe 86 PID 728 wrote to memory of 2108 728 cmd.exe 86 PID 728 wrote to memory of 1856 728 cmd.exe 87 PID 728 wrote to memory of 1856 728 cmd.exe 87 PID 728 wrote to memory of 4244 728 cmd.exe 88 PID 728 wrote to memory of 4244 728 cmd.exe 88 PID 728 wrote to memory of 1540 728 cmd.exe 90 PID 728 wrote to memory of 1540 728 cmd.exe 90 PID 728 wrote to memory of 4476 728 cmd.exe 91 PID 728 wrote to memory of 4476 728 cmd.exe 91 PID 728 wrote to memory of 3488 728 cmd.exe 92 PID 728 wrote to memory of 3488 728 cmd.exe 92 PID 728 wrote to memory of 452 728 cmd.exe 93 PID 728 wrote to memory of 452 728 cmd.exe 93 PID 728 wrote to memory of 1768 728 cmd.exe 95 PID 728 wrote to memory of 1768 728 cmd.exe 95 PID 728 wrote to memory of 4108 728 cmd.exe 96 PID 728 wrote to memory of 4108 728 cmd.exe 96 PID 728 wrote to memory of 2384 728 cmd.exe 97 PID 728 wrote to memory of 2384 728 cmd.exe 97 PID 728 wrote to memory of 1996 728 cmd.exe 98 PID 728 wrote to memory of 1996 728 cmd.exe 98 PID 728 wrote to memory of 876 728 cmd.exe 100 PID 728 wrote to memory of 876 728 cmd.exe 100 PID 728 wrote to memory of 2972 728 cmd.exe 101 PID 728 wrote to memory of 2972 728 cmd.exe 101 PID 728 wrote to memory of 4944 728 cmd.exe 102 PID 728 wrote to memory of 4944 728 cmd.exe 102 PID 728 wrote to memory of 644 728 cmd.exe 103 PID 728 wrote to memory of 644 728 cmd.exe 103 PID 728 wrote to memory of 2080 728 cmd.exe 104 PID 728 wrote to memory of 2080 728 cmd.exe 104 PID 728 wrote to memory of 1472 728 cmd.exe 105 PID 728 wrote to memory of 1472 728 cmd.exe 105 PID 728 wrote to memory of 1808 728 cmd.exe 106 PID 728 wrote to memory of 1808 728 cmd.exe 106 PID 728 wrote to memory of 1180 728 cmd.exe 107 PID 728 wrote to memory of 1180 728 cmd.exe 107 PID 728 wrote to memory of 3808 728 cmd.exe 108 PID 728 wrote to memory of 3808 728 cmd.exe 108 PID 728 wrote to memory of 1532 728 cmd.exe 109 PID 728 wrote to memory of 1532 728 cmd.exe 109 PID 728 wrote to memory of 3448 728 cmd.exe 110 PID 728 wrote to memory of 3448 728 cmd.exe 110 PID 728 wrote to memory of 2644 728 cmd.exe 111 PID 728 wrote to memory of 2644 728 cmd.exe 111 PID 728 wrote to memory of 2136 728 cmd.exe 112 PID 728 wrote to memory of 2136 728 cmd.exe 112 PID 728 wrote to memory of 316 728 cmd.exe 113 PID 728 wrote to memory of 316 728 cmd.exe 113 PID 316 wrote to memory of 3720 316 net.exe 114 PID 316 wrote to memory of 3720 316 net.exe 114 PID 728 wrote to memory of 228 728 cmd.exe 118 PID 728 wrote to memory of 228 728 cmd.exe 118 PID 228 wrote to memory of 1324 228 net.exe 119 PID 228 wrote to memory of 1324 228 net.exe 119 PID 728 wrote to memory of 4760 728 cmd.exe 122 PID 728 wrote to memory of 4760 728 cmd.exe 122 PID 728 wrote to memory of 3220 728 cmd.exe 123 PID 728 wrote to memory of 3220 728 cmd.exe 123
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 25421259151547581792⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 31082253039110592⤵PID:888
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 13280103431466118722⤵PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 849224818230556692⤵PID:1856
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 21933742520846289552⤵PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 170497181206224662⤵PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 221592433110683182852⤵PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:3488
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 13955318428172307792⤵PID:452
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 27948571225965632⤵PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 12887245961696583602⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 24841358131435244612⤵PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 23858619725672322352⤵PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 6108133601196140802⤵PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 14359878114889210662⤵PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 31828282958826442⤵PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 282831548418445219692⤵PID:644
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 101252353812770181512⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 130012457628849299012⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 2143262772222191122⤵PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 2735915298150777622⤵PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 10492916524286305412⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 11407160731050388862⤵PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 3145560061342580452⤵PID:3448
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 2591129973163687242⤵PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 4152131982104303112⤵PID:2136
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:3720
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:1324
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:4760
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:3220
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:2908
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5a84da0463e13b5966bfba0b43ecc8da8
SHA183182195ecbd579ffe6fbfbf08214721977741d3
SHA2566509a29008bbd9712bc1835447c93f03bcc48fcde68f1846c4cb51bea48b590b
SHA512af476211f28638cf502325146286ad1783e708ff1f27e8dc30f9114ae9239fe44b5359222d04c39991ac37e3a0fc6074915e7ba718e4d952aa8305c8d5b4876c