Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 22:17
Static task
static1
General
-
Target
33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe
-
Size
375KB
-
MD5
e61731ea56d0ae4dfc434348c0204925
-
SHA1
44dccbc5162966cf80d84fd5908effb24fdb02b1
-
SHA256
33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797
-
SHA512
f8cae56a393aaf1625033692c0664f4d7377ac533530625cc66105535117559cb6f85c29d708afdeebfe30335db55ecc035ca1583dfb11944e9c6d432475eec3
-
SSDEEP
6144:cv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:c4VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral1/memory/5004-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5004-137-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5004-138-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5004-139-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5004-141-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4984-151-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4984-155-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2188-159-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2188-160-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2188-161-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3296-180-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2188-181-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
pid Process 4984 SQLSerasi.exe 2188 SQLSerasi.exe 3296 SQLSerasi.exe 4620 SQLSerasi.exe -
resource yara_rule behavioral1/memory/5004-133-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5004-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5004-137-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5004-138-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5004-139-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5004-141-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4984-151-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4984-155-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2188-154-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2188-159-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2188-160-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2188-161-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3296-180-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2188-181-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3116 2188 WerFault.exe 87 -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 5004 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe Token: SeDebugPrivilege 4984 SQLSerasi.exe Token: SeDebugPrivilege 2188 SQLSerasi.exe Token: SeDebugPrivilege 2188 SQLSerasi.exe Token: SeDebugPrivilege 2188 SQLSerasi.exe Token: SeDebugPrivilege 3296 SQLSerasi.exe Token: SeDebugPrivilege 3296 SQLSerasi.exe Token: SeDebugPrivilege 4620 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4984 5004 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe 85 PID 5004 wrote to memory of 4984 5004 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe 85 PID 5004 wrote to memory of 4984 5004 33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe 85 PID 2188 wrote to memory of 3296 2188 SQLSerasi.exe 90 PID 2188 wrote to memory of 3296 2188 SQLSerasi.exe 90 PID 2188 wrote to memory of 3296 2188 SQLSerasi.exe 90 PID 2188 wrote to memory of 4620 2188 SQLSerasi.exe 92 PID 2188 wrote to memory of 4620 2188 SQLSerasi.exe 92 PID 2188 wrote to memory of 4620 2188 SQLSerasi.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe"C:\Users\Admin\AppData\Local\Temp\33542bfff3727131d00639ac7264ca3ae7806ede3af57245716fa46ba24a3797.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 5762⤵
- Program crash
PID:3116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2188 -ip 21881⤵PID:1080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39.4MB
MD5b55a6defde445c1e9f9e0e33a297d362
SHA1b9a01239db85b5f60ccd41c5dbe6f15e4d6635a0
SHA256c8f4c8a4ce47b8404e18456d7cc0322c6de6d686bf4c82445020d1eb28910e5d
SHA512f43064f132f24ad3de41da5f2109d39a019718252628f61b2656939fc460e4a9e5c13e7d84ccb57c04424c91fc909db86d04bbec424b7cee9b6a7a38a9377e58
-
Filesize
39.4MB
MD5b55a6defde445c1e9f9e0e33a297d362
SHA1b9a01239db85b5f60ccd41c5dbe6f15e4d6635a0
SHA256c8f4c8a4ce47b8404e18456d7cc0322c6de6d686bf4c82445020d1eb28910e5d
SHA512f43064f132f24ad3de41da5f2109d39a019718252628f61b2656939fc460e4a9e5c13e7d84ccb57c04424c91fc909db86d04bbec424b7cee9b6a7a38a9377e58
-
Filesize
39.4MB
MD5b55a6defde445c1e9f9e0e33a297d362
SHA1b9a01239db85b5f60ccd41c5dbe6f15e4d6635a0
SHA256c8f4c8a4ce47b8404e18456d7cc0322c6de6d686bf4c82445020d1eb28910e5d
SHA512f43064f132f24ad3de41da5f2109d39a019718252628f61b2656939fc460e4a9e5c13e7d84ccb57c04424c91fc909db86d04bbec424b7cee9b6a7a38a9377e58
-
Filesize
39.4MB
MD5b55a6defde445c1e9f9e0e33a297d362
SHA1b9a01239db85b5f60ccd41c5dbe6f15e4d6635a0
SHA256c8f4c8a4ce47b8404e18456d7cc0322c6de6d686bf4c82445020d1eb28910e5d
SHA512f43064f132f24ad3de41da5f2109d39a019718252628f61b2656939fc460e4a9e5c13e7d84ccb57c04424c91fc909db86d04bbec424b7cee9b6a7a38a9377e58
-
Filesize
39.4MB
MD5b55a6defde445c1e9f9e0e33a297d362
SHA1b9a01239db85b5f60ccd41c5dbe6f15e4d6635a0
SHA256c8f4c8a4ce47b8404e18456d7cc0322c6de6d686bf4c82445020d1eb28910e5d
SHA512f43064f132f24ad3de41da5f2109d39a019718252628f61b2656939fc460e4a9e5c13e7d84ccb57c04424c91fc909db86d04bbec424b7cee9b6a7a38a9377e58