Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04/12/2022, 05:49
General
-
Target
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b.exe
-
Size
121KB
-
MD5
1aa48fd8ced520290f7a5206f0812880
-
SHA1
27c0e8e57a14c08353652d601a2d46ddfd80ff55
-
SHA256
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b
-
SHA512
3c6be6decca881dffb5a085c1826d47ff8badf9da960372d3b53f567ce60eb0d4163e6e0583d581d7573a6f9dcab9f1e0755287bafd34c27c70d93da89982e5c
-
SSDEEP
3072:/bXHC0G9e5Ueo6kqFU6IvxwyyyhBIpKXvqi2:/bXC0nX0Vvy4IpQqB
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b.exe"C:\Users\Admin\AppData\Local\Temp\ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD51a50aedcb7d76feb510c9d04d44534a3
SHA100c81430a77c32a0f4ccdb73fb726755129f8e1d
SHA256d39105ef3c9ff1a7363bee5d19070ae3e208181f93acec2aa67bd933c9d08630
SHA51268d5658213557b43790bf238e259941ce76527c53f8571166c32acb9b28798ee3d463e7347dbcdeeca252075a3064431bfd18c02efc6dc063d78aacd45645edf
-
Filesize
117B
MD5e166bd9aa54ee59071d3905bf0b3a17f
SHA15299444743427d4d9a6a427140a6e4f6f1aaee3b
SHA2566289083e5383998b7053c831598cba50dfb5708671663f7e1900610efce9842e
SHA5125627962c96e63aad0526c11858187b49ccf1a040f183ecdd43f3a29328e0e71118ce64ea57a71c105b2f5ee23a98b97f556f4be9ce29a4b088f21f57ea6edb52
-
Filesize
811KB
MD5f6d91e0fafedff8c2f0ca8d723b11b3d
SHA175d343258f229462ac3979468d9c49ef221aaa81
SHA256da38df24f342325a1222e3bcce78b2f63fbf74e4d8508fc125c9f46072eb1694
SHA512471ff5d723ada4561f68908b51829ac33caa3851046ea4f981d2b2d93ce9896ba79604d25ebb0b62d8994dd632644d6fee49330a7f423493723ef66eba334327
-
Filesize
811KB
MD5f6d91e0fafedff8c2f0ca8d723b11b3d
SHA175d343258f229462ac3979468d9c49ef221aaa81
SHA256da38df24f342325a1222e3bcce78b2f63fbf74e4d8508fc125c9f46072eb1694
SHA512471ff5d723ada4561f68908b51829ac33caa3851046ea4f981d2b2d93ce9896ba79604d25ebb0b62d8994dd632644d6fee49330a7f423493723ef66eba334327
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
8KB
-
Filesize
332KB
