Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2022, 12:24

General

  • Target

    9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb.exe

  • Size

    375KB

  • MD5

    aa901de8af4d8401092c3e8c9798fd0c

  • SHA1

    dbed6973dab8c994a83fcbb5e536b4363d5f5803

  • SHA256

    9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb

  • SHA512

    069c9b1242fd8468b379557f86e035c0d4c53f6f99762a0abeab8f73a0ea5f112ee76b1e02c380543ee4dac2771fc9251bdc150743e802578a2e95d9385c624a

  • SSDEEP

    6144:r4v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:s4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 10 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb.exe
    "C:\Users\Admin\AppData\Local\Temp\9f18b7105df6cd2c31995ba0eecdc9e8edec0aaafe70bc283eb98c32bce9d1cb.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5016
  • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
    "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe
      "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 644
      2⤵
      • Program crash
      PID:524
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4540 -ip 4540
    1⤵
      PID:1712

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7cea0993c59ad0919ad51f05db20d42b

      SHA1

      7a9c0ba5a60be48af9c53bf4a82910e6fa10ac08

      SHA256

      eb351764411c913503ec24eb2316b4684739f7f8c42b861bde33610281eafe46

      SHA512

      e19182166ac16b8de587928e967f88cc832016f5dc840edaf171269dcb0e43e7f66551feaf1a4d17b4f6e1cce8ceaf1ad94a4b8c88e203ef267519801ae88e43

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7cea0993c59ad0919ad51f05db20d42b

      SHA1

      7a9c0ba5a60be48af9c53bf4a82910e6fa10ac08

      SHA256

      eb351764411c913503ec24eb2316b4684739f7f8c42b861bde33610281eafe46

      SHA512

      e19182166ac16b8de587928e967f88cc832016f5dc840edaf171269dcb0e43e7f66551feaf1a4d17b4f6e1cce8ceaf1ad94a4b8c88e203ef267519801ae88e43

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7cea0993c59ad0919ad51f05db20d42b

      SHA1

      7a9c0ba5a60be48af9c53bf4a82910e6fa10ac08

      SHA256

      eb351764411c913503ec24eb2316b4684739f7f8c42b861bde33610281eafe46

      SHA512

      e19182166ac16b8de587928e967f88cc832016f5dc840edaf171269dcb0e43e7f66551feaf1a4d17b4f6e1cce8ceaf1ad94a4b8c88e203ef267519801ae88e43

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7cea0993c59ad0919ad51f05db20d42b

      SHA1

      7a9c0ba5a60be48af9c53bf4a82910e6fa10ac08

      SHA256

      eb351764411c913503ec24eb2316b4684739f7f8c42b861bde33610281eafe46

      SHA512

      e19182166ac16b8de587928e967f88cc832016f5dc840edaf171269dcb0e43e7f66551feaf1a4d17b4f6e1cce8ceaf1ad94a4b8c88e203ef267519801ae88e43

    • C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe

      Filesize

      39.4MB

      MD5

      7cea0993c59ad0919ad51f05db20d42b

      SHA1

      7a9c0ba5a60be48af9c53bf4a82910e6fa10ac08

      SHA256

      eb351764411c913503ec24eb2316b4684739f7f8c42b861bde33610281eafe46

      SHA512

      e19182166ac16b8de587928e967f88cc832016f5dc840edaf171269dcb0e43e7f66551feaf1a4d17b4f6e1cce8ceaf1ad94a4b8c88e203ef267519801ae88e43

    • memory/176-177-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/176-176-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/176-174-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/216-175-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/216-178-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3048-142-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3048-134-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/3048-136-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3048-137-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3048-132-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/3048-138-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4540-155-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4540-159-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4540-157-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/4540-156-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/4540-149-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/5016-158-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB

    • memory/5016-152-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/5016-150-0x0000000010000000-0x0000000010362000-memory.dmp

      Filesize

      3.4MB

    • memory/5016-154-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB