Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
02/12/2022, 22:18
General
-
Target
542e1d139d60bbb917dc02d0b7f26cd2c51b689385fcbe9266f1a7f2a3a6ef4b.exe
-
Size
281KB
-
MD5
5c1161e185f07a4ba9e9b0bdfdeb9777
-
SHA1
cf8c6d9901c6a226cc9126cad498dcd2627b8189
-
SHA256
542e1d139d60bbb917dc02d0b7f26cd2c51b689385fcbe9266f1a7f2a3a6ef4b
-
SHA512
5d5bacf903940b7099a0e5bc1c97ce5247b5855df0e8f86d40a1413bb99690a5f3e8fc552d33dc441a9af9effeefa3e0e050ad97d76fc2b122080541e6bca936
-
SSDEEP
6144:F3KgeJd5QSE7MTZsAz0o8hFc2P84NeWGSm:1KgeJd5xEIfz+c2P8O
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\542e1d139d60bbb917dc02d0b7f26cd2c51b689385fcbe9266f1a7f2a3a6ef4b.exe"C:\Users\Admin\AppData\Local\Temp\542e1d139d60bbb917dc02d0b7f26cd2c51b689385fcbe9266f1a7f2a3a6ef4b.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 8162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3368 -ip 33681⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.1MB
MD5a313f26e7893219fed87dd1ba4d9d313
SHA15093cdf8835ec82a3a793c55fb87975ee3a0e351
SHA25697d5f80ef240c193eee506f33c16b217d1742e9faf2bfd88902c04f1665e9922
SHA5129f82765024da1fe17aa6ceeca6bc8b9c16cb3f01ea41f8c01e162dac7c42b04391eb329d2e243a3137836c38469956fafe55e654ecdacc50f11b5d22fe8901b3
-
Filesize
22.1MB
MD5a313f26e7893219fed87dd1ba4d9d313
SHA15093cdf8835ec82a3a793c55fb87975ee3a0e351
SHA25697d5f80ef240c193eee506f33c16b217d1742e9faf2bfd88902c04f1665e9922
SHA5129f82765024da1fe17aa6ceeca6bc8b9c16cb3f01ea41f8c01e162dac7c42b04391eb329d2e243a3137836c38469956fafe55e654ecdacc50f11b5d22fe8901b3
-
Filesize
544KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
156KB
-
Filesize
156KB