Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 14:25
Behavioral task
behavioral1
Sample
6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe
Resource
win7-20220812-en
General
-
Target
6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe
-
Size
141KB
-
MD5
6d8d48afc3782a3007d0b40c0f2b9252
-
SHA1
d33e622dd1e846c9fb4fa866ad126d6daa021fc4
-
SHA256
6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8
-
SHA512
76bc851202d0fb7b5640ae7a3598b478dbe907bcc77607e626caa3e8a1460563dd3db5a3e41d01c31c2f70beba610a715d8b03161464eb325a5f5087c2a95955
-
SSDEEP
3072:PmkFSPOOECpVKTbp3WpnAzDhZFYYJOGS5XzZQ82pCi0z:9zTb+AvNYIq5DZQhoZ
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x000b00000001311a-55.dat family_gh0strat behavioral1/files/0x000b00000001311a-56.dat family_gh0strat behavioral1/files/0x00140000000054ab-59.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1976 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1976 svchost.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files\NT_Path.gif 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe File opened for modification C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe File created C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\windows\Prefetch1276200.dll 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe 1976 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeRestorePrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeBackupPrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeRestorePrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeBackupPrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeRestorePrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeBackupPrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe Token: SeRestorePrivilege 1760 6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe"C:\Users\Admin\AppData\Local\Temp\6aaf78499150daca0cffe6c6419c4199bae084b6008e0cdb20a1daadb68afda8.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1976
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD55f7dcf4b70048570003b6244dd2f6de1
SHA19fe23c43da8b0f225d6dd0682fc2c90deacf89ec
SHA2564a54b6412b98fa5b5bb099131583f703a1f9e972f2df277d46da75ccf3ae790c
SHA5121664867208e2627e9791dc3975c14b97d3aaa9cda4c72759296db5ee718d6a98f2acff7830263902be4481b3eddadbda8421fcecb4f6d70f75e47c0775d16a00
-
Filesize
133B
MD517e8cb3cd333e162f3ec1521e3643aba
SHA198ab0d8052a13eb4ef43847b1508cd314e527e1a
SHA256765a10e5412d6d1c06df1474081fd807bc7d5f8706727a7d142828603a5385d7
SHA512907f572bcd41afd85fbe1e8adc2c91fe25ccfad46a897041e544e9d4ba17891e8df2f9195b720d8988903399486e79d64f6f89adf529d5a09153550c50752642
-
Filesize
17.2MB
MD516a94b409b87ca64740f8180b4b6f143
SHA1009a27545fb37539d0b422e48e597a144a3acaa4
SHA256e35a217d4c8b9f4aca09c003cc91bbf0103e0bf01cd1267ecebc31442b9709e1
SHA5129fc88bdae9d2db03d1b30b499486e05202fec0710e6f25c5fdc2b0d065a600b2c23c09658858f34252a2a8349c48e2abba104aa62f2a73ba1c2438bd282d6ce1
-
Filesize
17.2MB
MD516a94b409b87ca64740f8180b4b6f143
SHA1009a27545fb37539d0b422e48e597a144a3acaa4
SHA256e35a217d4c8b9f4aca09c003cc91bbf0103e0bf01cd1267ecebc31442b9709e1
SHA5129fc88bdae9d2db03d1b30b499486e05202fec0710e6f25c5fdc2b0d065a600b2c23c09658858f34252a2a8349c48e2abba104aa62f2a73ba1c2438bd282d6ce1