Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3ggpermV3.rar
windows10-2004-x64
1ggpermV3/A...64.exe
windows10-2004-x64
1ggpermV3/F...er.bat
windows10-2004-x64
1ggpermV3/N...on.dll
windows10-2004-x64
1ggpermV3/S...UI.dll
windows10-2004-x64
1ggpermV3/T...er.exe
windows10-2004-x64
ggpermV3/a...64.sys
windows10-2004-x64
1ggpermV3/ggpermV3.exe
windows10-2004-x64
3ggpermV3/m...er.bat
windows10-2004-x64
3ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.exe
windows10-2004-x64
1ggpermV3/s...er.pdb
windows10-2004-x64
3ggpermV3/s...g.json
windows10-2004-x64
3ggpermV3/woof.bat
windows10-2004-x64
8Resubmissions
09/11/2024, 22:49
241109-2r2veatfrl 1009/11/2024, 22:47
241109-2qkjqssrdz 1009/11/2024, 22:46
241109-2p2fvstfqj 1009/11/2024, 22:44
241109-2nsgkasrbt 1007/11/2024, 16:00
241107-tfl1taxpgl 1010/02/2024, 17:17
240210-vtnl8sge36 10Analysis
-
max time kernel
1770s -
max time network
1149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ggpermV3.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
ggpermV3/AMIDEWINx64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral3
Sample
ggpermV3/Final_Cleaner.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral4
Sample
ggpermV3/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
ggpermV3/Siticone.UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral6
Sample
ggpermV3/Trinity Cleaner.exe
Resource
win10v2004-20241007-en
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer
windows10-2004-x64
24 signatures
1800 seconds
Behavioral task
behavioral7
Sample
ggpermV3/amifldrv64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral8
Sample
ggpermV3/ggpermV3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral9
Sample
ggpermV3/macchanger.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral10
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral11
Sample
ggpermV3/sxghr-driver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral12
Sample
ggpermV3/sxghr-driver.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral13
Sample
ggpermV3/sxghr-driver.runtimeconfig.json
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
1800 seconds
General
-
Target
ggpermV3/woof.bat
-
Size
1KB
-
MD5
9dfe4e730dcc5e0d3951038ad2a095a1
-
SHA1
e033d9a40234b9544606ec4d603add264cb38841
-
SHA256
bfffd2faf6710e02912de0eec63b593f35a8bebef114932b4a4bc9c67fad59b8
-
SHA512
297e9950fd207687af957a94c5fb7d073bb89dcebdd6ee047fa0465f55bb95b42563c7310980bf1e41ca671a1f8c824e86dfe515b844f99f307965d199d8dbfd
Malware Config
Signatures
-
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4980 sc.exe 936 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3480 ipconfig.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 26 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeBackupPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeShutdownPrivilege 4464 svchost.exe Token: SeSystemEnvironmentPrivilege 4464 svchost.exe Token: SeManageVolumePrivilege 4464 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeSystemtimePrivilege 4464 svchost.exe Token: SeBackupPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeShutdownPrivilege 4464 svchost.exe Token: SeSystemEnvironmentPrivilege 4464 svchost.exe Token: SeUndockPrivilege 4464 svchost.exe Token: SeManageVolumePrivilege 4464 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeSystemtimePrivilege 4464 svchost.exe Token: SeBackupPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeShutdownPrivilege 4464 svchost.exe Token: SeSystemEnvironmentPrivilege 4464 svchost.exe Token: SeUndockPrivilege 4464 svchost.exe Token: SeManageVolumePrivilege 4464 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeSystemtimePrivilege 4464 svchost.exe Token: SeBackupPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeShutdownPrivilege 4464 svchost.exe Token: SeSystemEnvironmentPrivilege 4464 svchost.exe Token: SeUndockPrivilege 4464 svchost.exe Token: SeManageVolumePrivilege 4464 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeSystemtimePrivilege 4464 svchost.exe Token: SeBackupPrivilege 4464 svchost.exe Token: SeRestorePrivilege 4464 svchost.exe Token: SeShutdownPrivilege 4464 svchost.exe Token: SeSystemEnvironmentPrivilege 4464 svchost.exe Token: SeUndockPrivilege 4464 svchost.exe Token: SeManageVolumePrivilege 4464 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4464 svchost.exe Token: SeIncreaseQuotaPrivilege 4464 svchost.exe Token: SeSecurityPrivilege 4464 svchost.exe Token: SeTakeOwnershipPrivilege 4464 svchost.exe Token: SeLoadDriverPrivilege 4464 svchost.exe Token: SeSystemtimePrivilege 4464 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3884 2000 cmd.exe 84 PID 2000 wrote to memory of 3884 2000 cmd.exe 84 PID 2000 wrote to memory of 2772 2000 cmd.exe 85 PID 2000 wrote to memory of 2772 2000 cmd.exe 85 PID 2000 wrote to memory of 3900 2000 cmd.exe 86 PID 2000 wrote to memory of 3900 2000 cmd.exe 86 PID 2000 wrote to memory of 2700 2000 cmd.exe 88 PID 2000 wrote to memory of 2700 2000 cmd.exe 88 PID 2000 wrote to memory of 2380 2000 cmd.exe 89 PID 2000 wrote to memory of 2380 2000 cmd.exe 89 PID 2000 wrote to memory of 3488 2000 cmd.exe 90 PID 2000 wrote to memory of 3488 2000 cmd.exe 90 PID 2000 wrote to memory of 3572 2000 cmd.exe 91 PID 2000 wrote to memory of 3572 2000 cmd.exe 91 PID 2000 wrote to memory of 2568 2000 cmd.exe 92 PID 2000 wrote to memory of 2568 2000 cmd.exe 92 PID 2000 wrote to memory of 224 2000 cmd.exe 93 PID 2000 wrote to memory of 224 2000 cmd.exe 93 PID 2000 wrote to memory of 2832 2000 cmd.exe 95 PID 2000 wrote to memory of 2832 2000 cmd.exe 95 PID 2000 wrote to memory of 2052 2000 cmd.exe 96 PID 2000 wrote to memory of 2052 2000 cmd.exe 96 PID 2000 wrote to memory of 1812 2000 cmd.exe 97 PID 2000 wrote to memory of 1812 2000 cmd.exe 97 PID 2000 wrote to memory of 2756 2000 cmd.exe 98 PID 2000 wrote to memory of 2756 2000 cmd.exe 98 PID 2000 wrote to memory of 4000 2000 cmd.exe 99 PID 2000 wrote to memory of 4000 2000 cmd.exe 99 PID 2000 wrote to memory of 3940 2000 cmd.exe 100 PID 2000 wrote to memory of 3940 2000 cmd.exe 100 PID 2000 wrote to memory of 2276 2000 cmd.exe 101 PID 2000 wrote to memory of 2276 2000 cmd.exe 101 PID 2000 wrote to memory of 532 2000 cmd.exe 102 PID 2000 wrote to memory of 532 2000 cmd.exe 102 PID 2000 wrote to memory of 1612 2000 cmd.exe 103 PID 2000 wrote to memory of 1612 2000 cmd.exe 103 PID 2000 wrote to memory of 4852 2000 cmd.exe 105 PID 2000 wrote to memory of 4852 2000 cmd.exe 105 PID 2000 wrote to memory of 4668 2000 cmd.exe 106 PID 2000 wrote to memory of 4668 2000 cmd.exe 106 PID 2000 wrote to memory of 2636 2000 cmd.exe 107 PID 2000 wrote to memory of 2636 2000 cmd.exe 107 PID 2000 wrote to memory of 4792 2000 cmd.exe 108 PID 2000 wrote to memory of 4792 2000 cmd.exe 108 PID 2000 wrote to memory of 3936 2000 cmd.exe 109 PID 2000 wrote to memory of 3936 2000 cmd.exe 109 PID 2000 wrote to memory of 4504 2000 cmd.exe 110 PID 2000 wrote to memory of 4504 2000 cmd.exe 110 PID 2000 wrote to memory of 1936 2000 cmd.exe 111 PID 2000 wrote to memory of 1936 2000 cmd.exe 111 PID 2000 wrote to memory of 1532 2000 cmd.exe 112 PID 2000 wrote to memory of 1532 2000 cmd.exe 112 PID 2000 wrote to memory of 1524 2000 cmd.exe 113 PID 2000 wrote to memory of 1524 2000 cmd.exe 113 PID 1524 wrote to memory of 2476 1524 net.exe 114 PID 1524 wrote to memory of 2476 1524 net.exe 114 PID 2000 wrote to memory of 4228 2000 cmd.exe 121 PID 2000 wrote to memory of 4228 2000 cmd.exe 121 PID 4228 wrote to memory of 636 4228 net.exe 122 PID 4228 wrote to memory of 636 4228 net.exe 122 PID 2000 wrote to memory of 936 2000 cmd.exe 123 PID 2000 wrote to memory of 936 2000 cmd.exe 123 PID 2000 wrote to memory of 4980 2000 cmd.exe 124 PID 2000 wrote to memory of 4980 2000 cmd.exe 124
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ggpermV3\woof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 181441263420088138072⤵PID:3884
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SS 14783161117123108842⤵PID:2772
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 2144110908551542692⤵PID:3900
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SV 3110125588843314632⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BV 171651225311986251382⤵PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CS 302111348915994294642⤵PID:3488
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PSN 1356738269557112442⤵PID:3572
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SU AUTO2⤵PID:2568
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PAT 22424471480123682⤵PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /PPN 47241939312764302012⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /IV 260270518850119592⤵PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SM 30574247733109550392⤵PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SP 12491309816505301872⤵PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BS 116672036623545143582⤵PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SF 22101327082537755042⤵PID:3940
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BM 1399631821112231452⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BP 257102528619635290512⤵PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BT 264063047724015272882⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /BLC 132531269129788242782⤵PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CM 4244191421308219602⤵PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CT 3006128526327640962⤵PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CV 154033258425666232492⤵PID:4792
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CA 1366379216840208262⤵PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CO 30021845419048119672⤵PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /CSK 278942698700155622⤵PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\ggpermV3\AMIDEWINx64.EXEAMIDEWINx64.EXE /SK 91821396026744290112⤵PID:1532
-
-
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:2476
-
-
-
C:\Windows\system32\net.exenet start winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start winmgmt /y3⤵PID:636
-
-
-
C:\Windows\system32\sc.exesc stop winmgmt2⤵
- Launches sc.exe
PID:936
-
-
C:\Windows\system32\sc.exesc start winmgmt2⤵
- Launches sc.exe
PID:4980
-
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:3480
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
PID:3472 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5c24308d9d4e45f604b3fa23e59738ee2
SHA153539fed5fe665f6727efedbbaed1997be488015
SHA256ccdab7c1e2433e2d3635a428b028bb10c37718e9af49bba966c8d20bb5c12072
SHA5124646ef2df104e8dbe7ec1af4b33fe3d859143cb73314896adc13d3de281a2383f1465843bfa10773e4cfe5cdb5b853fa5a750f77c8b2eecbebb7b07f21d9a07c