cb5892e66ce5c2e7b5ab9946e77e1e634fdc5588a729ad6fdaaa4fd822f27051 | Triage

Analysis

max time kernel
172s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:03

Sharing

Report Analysis Logs

General

Target

Gh0st.exe
Size

3.4MB
MD5

437df1d6ecc5605108f034562c586886
SHA1

50097209d3da34c406aac85d27253eaabe63e12f
SHA256

dcc2afb9ff8f4b8e4e96999e11d0fedcb2fe0f67ae3f341f4412c0d90f9ab027
SHA512

5a75d28762ccd193b08ab9d49755a8866ab94d265161deaaf30bf7d915595a7d34c95c76b6ca4a9d2654e0cf278b91367a879eaa5bf7fbd2b01cb71cee18f03e
SSDEEP

49152:1GTFbIo5ByEbssT/qyXkXVOVNFNzIfjYVha+s9Bxgwu:1wt50ABUXqFqjW4+QBGw

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	Gh0st.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	Gh0st.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2100	Gh0st.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2100	Gh0st.exe
2100	Gh0st.exe
2100	Gh0st.exe

C:\Users\Admin\AppData\Local\Temp\Gh0st.exe
"C:\Users\Admin\AppData\Local\Temp\Gh0st.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads