Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 12:43

General

  • Target

    1f914f75bf05660835d99af49efcb2ef3783493f485eb4570f57edb8d8a56207.exe

  • Size

    375KB

  • MD5

    fa68c58e2bc7dbf216f3a958627d2d35

  • SHA1

    a4a014fec00ecea1a04e254470e6a5706e283e61

  • SHA256

    1f914f75bf05660835d99af49efcb2ef3783493f485eb4570f57edb8d8a56207

  • SHA512

    799dc3b685b960cb9e232e793132a8c8bf6ccc4e133203f2adcbe0430e269d52a9c96d687fcab0a8ef413a04e43624a162db130286176ec0a65465c8134d7942

  • SSDEEP

    6144:tv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:t4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 9 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f914f75bf05660835d99af49efcb2ef3783493f485eb4570f57edb8d8a56207.exe
    "C:\Users\Admin\AppData\Local\Temp\1f914f75bf05660835d99af49efcb2ef3783493f485eb4570f57edb8d8a56207.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
    "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 628
      2⤵
      • Program crash
      PID:4888
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 900 -ip 900
    1⤵
      PID:3220
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k netsvcs -p
      1⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:32

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7ede4c43ade35c76e5bd040b2384172f

      SHA1

      c05c153b3ebfa981784f5cc6e032a2780b5a4c33

      SHA256

      b10b16fa169bc32184ace89c71fe8c43a0a85929b340a773e933305abb9b17bc

      SHA512

      e533b2b75eb73b65a5734a51017b0449c3cb0e95e7b7f0ac932f35b4874a32fd17756074fc4cdbb1a1b2fe25cf671fde8bca5b40261b9540fa3df4201ee51493

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7ede4c43ade35c76e5bd040b2384172f

      SHA1

      c05c153b3ebfa981784f5cc6e032a2780b5a4c33

      SHA256

      b10b16fa169bc32184ace89c71fe8c43a0a85929b340a773e933305abb9b17bc

      SHA512

      e533b2b75eb73b65a5734a51017b0449c3cb0e95e7b7f0ac932f35b4874a32fd17756074fc4cdbb1a1b2fe25cf671fde8bca5b40261b9540fa3df4201ee51493

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7ede4c43ade35c76e5bd040b2384172f

      SHA1

      c05c153b3ebfa981784f5cc6e032a2780b5a4c33

      SHA256

      b10b16fa169bc32184ace89c71fe8c43a0a85929b340a773e933305abb9b17bc

      SHA512

      e533b2b75eb73b65a5734a51017b0449c3cb0e95e7b7f0ac932f35b4874a32fd17756074fc4cdbb1a1b2fe25cf671fde8bca5b40261b9540fa3df4201ee51493

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7ede4c43ade35c76e5bd040b2384172f

      SHA1

      c05c153b3ebfa981784f5cc6e032a2780b5a4c33

      SHA256

      b10b16fa169bc32184ace89c71fe8c43a0a85929b340a773e933305abb9b17bc

      SHA512

      e533b2b75eb73b65a5734a51017b0449c3cb0e95e7b7f0ac932f35b4874a32fd17756074fc4cdbb1a1b2fe25cf671fde8bca5b40261b9540fa3df4201ee51493

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7ede4c43ade35c76e5bd040b2384172f

      SHA1

      c05c153b3ebfa981784f5cc6e032a2780b5a4c33

      SHA256

      b10b16fa169bc32184ace89c71fe8c43a0a85929b340a773e933305abb9b17bc

      SHA512

      e533b2b75eb73b65a5734a51017b0449c3cb0e95e7b7f0ac932f35b4874a32fd17756074fc4cdbb1a1b2fe25cf671fde8bca5b40261b9540fa3df4201ee51493

    • memory/900-155-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/900-160-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/900-158-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/900-157-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/900-151-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/900-154-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3120-179-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3120-175-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3560-136-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3560-139-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3560-147-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3560-137-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3560-132-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3560-133-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3560-138-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4980-180-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4980-181-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4980-178-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/4980-176-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/4980-177-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/5100-144-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/5100-156-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/5100-159-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB