Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
28/08/2023, 02:04
General
-
Target
f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274.exe
-
Size
356KB
-
MD5
59b60bc722bfaa37c8984e4480f85ebe
-
SHA1
89525a4d44251f01f9edbbb5c04a8d98ba162d63
-
SHA256
f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274
-
SHA512
e4527f3d959ad144224e5e4c6d16cc6b5dd20210d0e9d7aae3b65823e4c84c76642029f2a4d1891590bed27cc0ebfea09a3ca26ac9a1487fc5c91d34bb970672
-
SSDEEP
6144:d+8GZSKnqykOol/TrY9bk+PUyIfsciElZw5au/q+v/M7iFAcGXqI:eSKn/mTM9g+sxfPiEz1oq+3M7gdGXqI
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274.exe"C:\Users\Admin\AppData\Local\Temp\f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\windows\Owocoe.comC:\windows\Owocoe.com -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\windows\Owocoe.comC:\windows\Owocoe.com -acsi2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
MD559b60bc722bfaa37c8984e4480f85ebe
SHA189525a4d44251f01f9edbbb5c04a8d98ba162d63
SHA256f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274
SHA512e4527f3d959ad144224e5e4c6d16cc6b5dd20210d0e9d7aae3b65823e4c84c76642029f2a4d1891590bed27cc0ebfea09a3ca26ac9a1487fc5c91d34bb970672
-
Filesize
356KB
MD559b60bc722bfaa37c8984e4480f85ebe
SHA189525a4d44251f01f9edbbb5c04a8d98ba162d63
SHA256f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274
SHA512e4527f3d959ad144224e5e4c6d16cc6b5dd20210d0e9d7aae3b65823e4c84c76642029f2a4d1891590bed27cc0ebfea09a3ca26ac9a1487fc5c91d34bb970672
-
Filesize
19B
MD5fe9af7587d65300338177538aa72f924
SHA1c8ae231d3ae13f9db8b9f16e188e951e7cb76377
SHA256556243e27a369fbdff1ecfb413b7540f1eb4e6becba03b76d221443b0d022351
SHA5123bffe70c5daea4d6be501278be067bbc02e7ac211fef33629b5447ef498d49af7cbe25f994e33c2835bd9963749c07edc789fddd918e1c7739b77422ff57cf3e
-
Filesize
4B
MD5ccf8111910291ba472b385e9c5f59099
SHA149c2ad0acc151a565bf00a30b012471a984c42b6
SHA256214c993d16c6ca97becc711cae8eee69336bc377d097f225c72ae4fd01cbc018
SHA5121575a0ae17202ba849478ffa2a97e69bd9612df9ef38f01bd96514442c399ee4d31151cb7197f891ded60f74c272ec9e5b0a3a63b7f020b79f37083d910f3a2b
-
Filesize
356KB
MD559b60bc722bfaa37c8984e4480f85ebe
SHA189525a4d44251f01f9edbbb5c04a8d98ba162d63
SHA256f2b8bd06ce83ece8e1325c467b51ec43b8d72599fedb4d0386832888f70e1274
SHA512e4527f3d959ad144224e5e4c6d16cc6b5dd20210d0e9d7aae3b65823e4c84c76642029f2a4d1891590bed27cc0ebfea09a3ca26ac9a1487fc5c91d34bb970672
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
224KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB
-
Filesize
372KB