Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/10/2022, 13:16 UTC
General
-
Target
e3d9f812f239413941941086ed157ef80735d70f76873fc1e8141f2ac5e3f648.exe
-
Size
39KB
-
MD5
3697872eb74777ad7075dd6cd529edc0
-
SHA1
217f4af3aea4ad2ee02c1bb53e3223f9f18506c1
-
SHA256
e3d9f812f239413941941086ed157ef80735d70f76873fc1e8141f2ac5e3f648
-
SHA512
01d3984dbaa07a5528c2e61b65a0b01292bd9106d319d67a02326dd0487be2924bb0c3e7b0d886b58aac1e0056db14836aabd4cd80acf8b2e3fa3623187960eb
-
SSDEEP
768:JKqq1uaVze+uFNSlcUkFR1Df0ermMUXIisUaAsJ/APII:JKqauaVzebGcD/f+9X/WAh
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3d9f812f239413941941086ed157ef80735d70f76873fc1e8141f2ac5e3f648.exe"C:\Users\Admin\AppData\Local\Temp\e3d9f812f239413941941086ed157ef80735d70f76873fc1e8141f2ac5e3f648.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
-
DNSwww.sfbazhu.comRemote address:8.8.8.8:53Requestwww.sfbazhu.comIN AResponse
-
8.8.8.8:53www.sfbazhu.comdns
DNS Request
www.sfbazhu.com
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD547e638ba159126d58216f99e640b8ea1
SHA146816e8734562a5fd7a9aecbec9661f92a624fbe
SHA2565c16257ee22ccb24890b7330e3d2de3e412ad2968e0c70280a22f338e7c0daac
SHA51207f84228958e2f396f864fcc1c7772087d74e29286f9c327340e53cf459350ed0d9e5b6e1c4ea0eff0cf40bf302b00f1f2e8bc3da286a0e4f674ec84292f44c9
-
Filesize
117B
MD547b02af9bcfc2e47745a836c694d6f70
SHA16f7a365a4bad72806a137db8e19ba22911801068
SHA2561b3137be92d667234afc8e28f16e147e7545852402ddd3c3d2841a58c70dad13
SHA512b0350a74bedaa7b5fc9b1f808ad60cdbd68045d1f567e55bdb84cf8b9874270eb9331d0c0b48e9c9b9504980a4d02150cd1d9770038bff4449f2f8992169725b
-
Filesize
4.1MB
MD5be6927b3a2b936e12d9a8fdecea6b87b
SHA1982942818da7faa50a7ff5f81dd50c1240da1110
SHA2563e77564fb8c35486467c7b6de542cae728b0f49d731ba00e024461e33e488e11
SHA512415207191c178f8e33f03acfda9d58db37722f3a7f3d34b0c20dde9f6cb0df211decf318813dcc6d3a73d8a8d4e4cba0ed684255e17b3f7aa161911d52803f6a
-
Filesize
4.1MB
MD5be6927b3a2b936e12d9a8fdecea6b87b
SHA1982942818da7faa50a7ff5f81dd50c1240da1110
SHA2563e77564fb8c35486467c7b6de542cae728b0f49d731ba00e024461e33e488e11
SHA512415207191c178f8e33f03acfda9d58db37722f3a7f3d34b0c20dde9f6cb0df211decf318813dcc6d3a73d8a8d4e4cba0ed684255e17b3f7aa161911d52803f6a
-
Filesize
8KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
