Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 15:54

General

  • Target

    e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe

  • Size

    156KB

  • MD5

    638d922d3a1acb3756dda409b8b50700

  • SHA1

    6c416852f4c750931281b76fa6e69a9996da7882

  • SHA256

    e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b

  • SHA512

    a5e400a843be5b102be00a5fb30f96970d7b18f2f2259fadd2c6e721461ceacd0239737f05bfae6348887d03e5c81f89505e28cd75d09e5c6240607acb325d6a

  • SSDEEP

    3072:dVZd5rnmoWOQrkdJv5hMFULTvtcMk8Lyji8lkivl05Kui+ITqn:dXd5rmoWOQsJRG4GMkSQi8Tvl05KuDIk

Malware Config

Signatures

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
    "C:\Users\Admin\AppData\Local\Temp\e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\incgzwjvl.exe
      C:\Windows\System32\incgzwjvl.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\userinit.exe
        userinit.exe
        3⤵
        • Loads dropped DLL
        PID:996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7090417_lang.dll

    Filesize

    114KB

    MD5

    7a85ba37dc260fe2c5965a5dd8b871ec

    SHA1

    9bc76aeb32f7ade4d08bb31bec8e4ff2d13f7a95

    SHA256

    07203b92e94a485a3c8adb42da363af75071035390cdd8e80bf4bf0606f3582e

    SHA512

    81f854722b3de801e38436bd74c8a3a6ba2e49e9087bfa3146affc853a8041a357288396ed2b1c3f1ebcfbcfffb6a86d6c05ee75c5223ccbfcd52ee238afaf03

  • C:\Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • C:\Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • \Users\Admin\AppData\Local\Temp\7090417_lang.dll

    Filesize

    114KB

    MD5

    7a85ba37dc260fe2c5965a5dd8b871ec

    SHA1

    9bc76aeb32f7ade4d08bb31bec8e4ff2d13f7a95

    SHA256

    07203b92e94a485a3c8adb42da363af75071035390cdd8e80bf4bf0606f3582e

    SHA512

    81f854722b3de801e38436bd74c8a3a6ba2e49e9087bfa3146affc853a8041a357288396ed2b1c3f1ebcfbcfffb6a86d6c05ee75c5223ccbfcd52ee238afaf03

  • \Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • \Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • \Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • \Windows\SysWOW64\incgzwjvl.exe

    Filesize

    156KB

    MD5

    28f55b69fd74a9bfc691b96b1f02bcd0

    SHA1

    992861ea3ba51aecbb2a9546e663770ff3db8fb0

    SHA256

    92ac673b00e9cd7d77af3bc78a4acbce00fbbc04e61acb0fe9d79807d7dbc3c2

    SHA512

    b8704be0f88704457395c0bf9cd7864ee9b9339c38bd1af5c9f54b113bf88d9f78803147a018ea69704355eaebec4ea0dd33b351d9165db83f33a096a834f243

  • memory/1680-54-0x0000000075921000-0x0000000075923000-memory.dmp

    Filesize

    8KB