Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:03

General

  • Target

    ccf51dd39652a4ba353a55bc00952302b2c54b5a73e8547ac0d0e3fdfff35775.exe

  • Size

    376KB

  • MD5

    b9cdc9775b5efd4d5974c1f6e4e25a3c

  • SHA1

    5fe0fbc8808f0a0cfb75816b904ed3cc2c0cb827

  • SHA256

    ccf51dd39652a4ba353a55bc00952302b2c54b5a73e8547ac0d0e3fdfff35775

  • SHA512

    56c9a49eed7d0cf9cc989611da76139c4b987282a299f0644d2bcfd7992540a6f25dba9173ca154cd83273d537e09a3a845d4e50f5bccf2dccad6e2e84742017

  • SSDEEP

    6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJH7i:jt0VPFfsKAkrbPl7i

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccf51dd39652a4ba353a55bc00952302b2c54b5a73e8547ac0d0e3fdfff35775.exe
    "C:\Users\Admin\AppData\Local\Temp\ccf51dd39652a4ba353a55bc00952302b2c54b5a73e8547ac0d0e3fdfff35775.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1064
    • \??\c:\Windows\(null)0.exe
      c:\Windows\(null)0.exe
      2⤵
      • Executes dropped EXE
      PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\(null)0.exe

    Filesize

    376KB

    MD5

    aeac1f42453059be4a43ffdd36483c1e

    SHA1

    ab51bd1081fae3d82d5f301f9a3491f76030ad00

    SHA256

    53b963c380c7e59ccdbf4f9b11da8fdb7786a92aa7ef2c3a34953c4263a397c9

    SHA512

    36147c4ea10bae15c453ed305b8e8db2fa78f0be3c41a38630fc322e070dc0f33838a6140bd8ff5c96de1703112b2b771d0585408413d1ca31f9f9af0ff39736

  • memory/1064-54-0x0000000075501000-0x0000000075503000-memory.dmp

    Filesize

    8KB

  • memory/1064-59-0x0000000002740000-0x0000000002831000-memory.dmp

    Filesize

    964KB

  • memory/1616-58-0x0000000000400000-0x00000000004F1000-memory.dmp

    Filesize

    964KB