Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2023, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
-
Size
2.2MB
-
MD5
2d7288e193e533dafab9d8c2f2038e6f
-
SHA1
52f0067ede836a52a144f52520c37a24421b1a3c
-
SHA256
79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b
-
SHA512
6948377720d4eb0bc153289aa004696869264bd99940ed894b02689672d68032346360e2d49bb406d8764e42a982c93bdb8b3db08646ec275f9dbb279f92f445
-
SSDEEP
24576:xL9QwSgxmxylZViyf6KOGSKC891D8vRMFgcvahnsCYXDC1SROmDn3I:xffwGSf8CRMFgcvrXGSRBDn3I
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/1832-6673-0x0000000010000000-0x000000001008E000-memory.dmp family_gh0strat behavioral2/memory/1832-6677-0x0000000000400000-0x000000000062C000-memory.dmp family_gh0strat -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe Token: SeIncBasePriorityPrivilege 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe Token: 33 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe Token: SeIncBasePriorityPrivilege 1832 79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe"C:\Users\Admin\AppData\Local\Temp\79dea9f7af27c82546d6a0a5f2585e613cfd594e7f747b7136886e623bf1fa2b.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1832