Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230824-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2023, 01:02

General

  • Target

    46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.exe

  • Size

    524KB

  • MD5

    20320bd328c8a9ab7ebacd0b7827c742

  • SHA1

    8a66676b0a4926a9525630f6b4ec7a106db3e27f

  • SHA256

    46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a

  • SHA512

    151a1d9db7f4162417e0f0bedd21d2442d16330003466b76d1055d099360262f0e4f72411125fda2302c531d2845e3ea620aeea3616c5172dcb194fef276a646

  • SSDEEP

    12288:KQb8e55GXwhEIGmcuRrv0CbU4j0ARGohKRjP7Kt+V7UB1ZSQCVmzdditQxL5NLlg:L5pKpOd/GTV5nJ

Malware Config

Signatures

  • Gh0st RAT payload 4 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.exe
    "C:\Users\Admin\AppData\Local\Temp\46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Users\Admin\AppData\Roaming\Microsoft\e583208.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\e583208.exe" dmedmedme "C:\Users\Admin\AppData\Local\Temp\46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4712
      • \??\c:\windows\SysWOW64\notepad.exe
        c:\windows\system32\notepad.exe "C:\Users\Admin\AppData\Local\Temp\46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.txt"
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:752
      • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        PID:1384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a.txt

    Filesize

    286KB

    MD5

    4adabc4d645b74a87290b1d7d98de89b

    SHA1

    ec1d2249bcf87065c3e48e40da1abb281336aeac

    SHA256

    3677725d74284483f4c7a36580b890897821ff8eb91a472dab82fdf6cc9eb4cb

    SHA512

    040b5cf460402d3809693669c2d71f33d071c0a084b2a4a5f31d49df39411f9c7e190769ccb46edfa8e5f7289d4ed7f2ffdca4a8d173b0f391c71da348fbce7e

  • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe

    Filesize

    192KB

    MD5

    0122ed05571e241a00c96f7f4fb10b8a

    SHA1

    c7ca58693d39f4864336acf4dd1808fc8c6eb47c

    SHA256

    42b3bdeb900281dcb17c3f0bc91c8c9ff914b134b5bec6cd6e922c584f338bb0

    SHA512

    3fbf8b03606af8292d24c529415b59463ce4fdb3607a3e8683360ecbff45033a72dfc443cc0663bf8a74e8d43a3e24245edb1d995d312fc756bf4b877ef5f89c

  • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe

    Filesize

    192KB

    MD5

    0122ed05571e241a00c96f7f4fb10b8a

    SHA1

    c7ca58693d39f4864336acf4dd1808fc8c6eb47c

    SHA256

    42b3bdeb900281dcb17c3f0bc91c8c9ff914b134b5bec6cd6e922c584f338bb0

    SHA512

    3fbf8b03606af8292d24c529415b59463ce4fdb3607a3e8683360ecbff45033a72dfc443cc0663bf8a74e8d43a3e24245edb1d995d312fc756bf4b877ef5f89c

  • C:\Users\Admin\AppData\Roaming\Microsoft\e583208.exe

    Filesize

    524KB

    MD5

    20320bd328c8a9ab7ebacd0b7827c742

    SHA1

    8a66676b0a4926a9525630f6b4ec7a106db3e27f

    SHA256

    46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a

    SHA512

    151a1d9db7f4162417e0f0bedd21d2442d16330003466b76d1055d099360262f0e4f72411125fda2302c531d2845e3ea620aeea3616c5172dcb194fef276a646

  • C:\Users\Admin\AppData\Roaming\Microsoft\e583208.exe

    Filesize

    524KB

    MD5

    20320bd328c8a9ab7ebacd0b7827c742

    SHA1

    8a66676b0a4926a9525630f6b4ec7a106db3e27f

    SHA256

    46062feff144c57dfdb69096b765be5b2e6e7fa3493cf0669b7163acbc51c48a

    SHA512

    151a1d9db7f4162417e0f0bedd21d2442d16330003466b76d1055d099360262f0e4f72411125fda2302c531d2845e3ea620aeea3616c5172dcb194fef276a646

  • memory/1384-12-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/1384-11-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/1384-9-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/1384-13-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/1384-15-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/1384-17-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/1384-25-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/1384-24-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB