Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/10/2022, 03:25

General

  • Target

    3d840979257b235dfdeb8960ceda886d4769ccf070f79ff7a4fb052fe3698687.exe

  • Size

    375KB

  • MD5

    66080f60e12b2b932c34818c43584cb3

  • SHA1

    05fa1f8edf995a4804ad4ccdc38aacc2ea8dc605

  • SHA256

    3d840979257b235dfdeb8960ceda886d4769ccf070f79ff7a4fb052fe3698687

  • SHA512

    7e09c52cbc3769c647b49216f6f448f31774970b78925c8d8b965ab2d7085529e721975822f6862b3e696b4c473c6eb6522b4951611eb6725535a8bc651585ac

  • SSDEEP

    6144:Zv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:Z4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 10 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d840979257b235dfdeb8960ceda886d4769ccf070f79ff7a4fb052fe3698687.exe
    "C:\Users\Admin\AppData\Local\Temp\3d840979257b235dfdeb8960ceda886d4769ccf070f79ff7a4fb052fe3698687.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3372
  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
    "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

    Filesize

    39.4MB

    MD5

    639aed4293bccf269024ff4eb75c88ae

    SHA1

    f1b160d7dff9aed93b840d87142512c9dd652a60

    SHA256

    18eb36620c3ce13f4f32af1fd02610b11085047e2aa39cc9b850cb2bcb9a1af7

    SHA512

    e316c4617cfd3ccb15f9d9b42b95b343dd5eb9879aaac071482e61caa9fae8856e94ed9a23a2426f7f5ac501cc9b5757a17834a4046393ef51fbc5c350243420

  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

    Filesize

    39.4MB

    MD5

    639aed4293bccf269024ff4eb75c88ae

    SHA1

    f1b160d7dff9aed93b840d87142512c9dd652a60

    SHA256

    18eb36620c3ce13f4f32af1fd02610b11085047e2aa39cc9b850cb2bcb9a1af7

    SHA512

    e316c4617cfd3ccb15f9d9b42b95b343dd5eb9879aaac071482e61caa9fae8856e94ed9a23a2426f7f5ac501cc9b5757a17834a4046393ef51fbc5c350243420

  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

    Filesize

    39.4MB

    MD5

    639aed4293bccf269024ff4eb75c88ae

    SHA1

    f1b160d7dff9aed93b840d87142512c9dd652a60

    SHA256

    18eb36620c3ce13f4f32af1fd02610b11085047e2aa39cc9b850cb2bcb9a1af7

    SHA512

    e316c4617cfd3ccb15f9d9b42b95b343dd5eb9879aaac071482e61caa9fae8856e94ed9a23a2426f7f5ac501cc9b5757a17834a4046393ef51fbc5c350243420

  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

    Filesize

    39.4MB

    MD5

    639aed4293bccf269024ff4eb75c88ae

    SHA1

    f1b160d7dff9aed93b840d87142512c9dd652a60

    SHA256

    18eb36620c3ce13f4f32af1fd02610b11085047e2aa39cc9b850cb2bcb9a1af7

    SHA512

    e316c4617cfd3ccb15f9d9b42b95b343dd5eb9879aaac071482e61caa9fae8856e94ed9a23a2426f7f5ac501cc9b5757a17834a4046393ef51fbc5c350243420

  • memory/1264-303-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/1264-374-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/1264-373-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2064-155-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-160-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-124-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-125-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-126-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-127-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-128-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-129-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-130-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-131-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-132-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-133-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-134-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-135-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-136-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-137-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-139-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-138-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-140-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-141-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-142-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-143-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-144-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-145-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-146-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-147-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-148-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-159-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-150-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-151-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-152-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-153-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-154-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-122-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-156-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-157-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-123-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-158-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-149-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-161-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-162-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-163-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-164-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-165-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-166-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-167-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-169-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-168-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2064-170-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-171-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/2064-174-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-175-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/2064-176-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/2064-177-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/2064-178-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-179-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-180-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-181-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-182-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-183-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-184-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-185-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-186-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2064-189-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/2064-199-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2064-120-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/2064-121-0x0000000077840000-0x00000000779CE000-memory.dmp

    Filesize

    1.6MB

  • memory/3372-304-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/3372-251-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/4732-359-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/4732-362-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB

  • memory/4732-375-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/4732-376-0x0000000010000000-0x0000000010362000-memory.dmp

    Filesize

    3.4MB