Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21/09/2023, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe
Resource
win10v2004-20230915-en
General
-
Target
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe
-
Size
1.0MB
-
MD5
2e7b56329ff02982ce0ed6cc645a22e7
-
SHA1
c04483bf2fe79280b7062198a0ab42e0cb3bccbc
-
SHA256
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
-
SHA512
e9f24c855a5140085f2863735f0d867be1167cea7573963480478c62220dc8ed8940ea915d47e9814f4de1e80a1e28161169a84dc1d7ab47f28aae98bae8d45e
-
SSDEEP
12288:R1ec/eFqGZyUgCraUIk2yFqR+lIaaiEOqN/L0FgEhBCpJJNn8/MPr4OsnM:be7qGEUgCPr24qR+aaHEx/wFvUPEOs
Malware Config
Extracted
gh0strat
47.97.163.157
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1052-8-0x0000000010000000-0x000000001001D000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
pid Process 2932 ·ÀºÚÆÁ2.exe 2532 ShowsWinse.exe 2640 ·ÀºÚÆÁ2.exe -
Loads dropped DLL 2 IoCs
pid Process 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FHPP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\·ÀºÚÆÁ2.exe" ·ÀºÚÆÁ2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FHPP = "C:\\Windows\\·ÀºÚÆÁ2.exe" ·ÀºÚÆÁ2.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\·ÀºÚÆÁ2.exe ShowsWinse.exe File created C:\Windows\ShowsWinse.exe ShowsWinse.exe File created C:\Windows\ShowsWinse.exe 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe File opened for modification C:\Windows\ShowsWinse.exe 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2412 schtasks.exe 2628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2932 ·ÀºÚÆÁ2.exe 2932 ·ÀºÚÆÁ2.exe 2640 ·ÀºÚÆÁ2.exe 2640 ·ÀºÚÆÁ2.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2932 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 28 PID 1052 wrote to memory of 2932 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 28 PID 1052 wrote to memory of 2932 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 28 PID 1052 wrote to memory of 2932 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 28 PID 1052 wrote to memory of 2628 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 29 PID 1052 wrote to memory of 2628 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 29 PID 1052 wrote to memory of 2628 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 29 PID 1052 wrote to memory of 2628 1052 9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe 29 PID 2824 wrote to memory of 2532 2824 taskeng.exe 32 PID 2824 wrote to memory of 2532 2824 taskeng.exe 32 PID 2824 wrote to memory of 2532 2824 taskeng.exe 32 PID 2824 wrote to memory of 2532 2824 taskeng.exe 32 PID 2532 wrote to memory of 2640 2532 ShowsWinse.exe 33 PID 2532 wrote to memory of 2640 2532 ShowsWinse.exe 33 PID 2532 wrote to memory of 2640 2532 ShowsWinse.exe 33 PID 2532 wrote to memory of 2640 2532 ShowsWinse.exe 33 PID 2532 wrote to memory of 2412 2532 ShowsWinse.exe 34 PID 2532 wrote to memory of 2412 2532 ShowsWinse.exe 34 PID 2532 wrote to memory of 2412 2532 ShowsWinse.exe 34 PID 2532 wrote to memory of 2412 2532 ShowsWinse.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe"C:\Users\Admin\AppData\Local\Temp\9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\·ÀºÚÆÁ2.exeC:\Users\Admin\AppData\Local\Temp\·ÀºÚÆÁ2.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2932
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "ShowsWin" /tr C:\Windows\ShowsWinse.exe /f2⤵
- Creates scheduled task(s)
PID:2628
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A52D1656-AF76-4EF7-91F4-38B46FE5CF5A} S-1-5-21-3750544865-3773649541-1858556521-1000:XOCYHKRS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\ShowsWinse.exeC:\Windows\ShowsWinse.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\·ÀºÚÆÁ2.exeC:\Windows\·ÀºÚÆÁ2.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "ShowsWin" /tr C:\Windows\ShowsWinse.exe /f3⤵
- Creates scheduled task(s)
PID:2412
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD552b8ff9e93b3ed7d23f1be5737fe9fd6
SHA19dc246cbba5e4e103cbab5642f9bc00375aa01e8
SHA2569fac08b760dbd1ba11421fd0a1f3c4297527752dd31c38f2d16098420a5d8342
SHA5122ebf43f646968a9d9a68a996f2f5522a14b8a04fe732bc3718744d929ee3e53eb367d3ea0521fa29b4b091243cd6ce17a66875cc09a91cd570ed48403b2c995f
-
Filesize
780KB
MD552b8ff9e93b3ed7d23f1be5737fe9fd6
SHA19dc246cbba5e4e103cbab5642f9bc00375aa01e8
SHA2569fac08b760dbd1ba11421fd0a1f3c4297527752dd31c38f2d16098420a5d8342
SHA5122ebf43f646968a9d9a68a996f2f5522a14b8a04fe732bc3718744d929ee3e53eb367d3ea0521fa29b4b091243cd6ce17a66875cc09a91cd570ed48403b2c995f
-
Filesize
1.0MB
MD52e7b56329ff02982ce0ed6cc645a22e7
SHA1c04483bf2fe79280b7062198a0ab42e0cb3bccbc
SHA2569d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
SHA512e9f24c855a5140085f2863735f0d867be1167cea7573963480478c62220dc8ed8940ea915d47e9814f4de1e80a1e28161169a84dc1d7ab47f28aae98bae8d45e
-
Filesize
1.0MB
MD52e7b56329ff02982ce0ed6cc645a22e7
SHA1c04483bf2fe79280b7062198a0ab42e0cb3bccbc
SHA2569d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
SHA512e9f24c855a5140085f2863735f0d867be1167cea7573963480478c62220dc8ed8940ea915d47e9814f4de1e80a1e28161169a84dc1d7ab47f28aae98bae8d45e
-
Filesize
780KB
MD552b8ff9e93b3ed7d23f1be5737fe9fd6
SHA19dc246cbba5e4e103cbab5642f9bc00375aa01e8
SHA2569fac08b760dbd1ba11421fd0a1f3c4297527752dd31c38f2d16098420a5d8342
SHA5122ebf43f646968a9d9a68a996f2f5522a14b8a04fe732bc3718744d929ee3e53eb367d3ea0521fa29b4b091243cd6ce17a66875cc09a91cd570ed48403b2c995f
-
Filesize
780KB
MD552b8ff9e93b3ed7d23f1be5737fe9fd6
SHA19dc246cbba5e4e103cbab5642f9bc00375aa01e8
SHA2569fac08b760dbd1ba11421fd0a1f3c4297527752dd31c38f2d16098420a5d8342
SHA5122ebf43f646968a9d9a68a996f2f5522a14b8a04fe732bc3718744d929ee3e53eb367d3ea0521fa29b4b091243cd6ce17a66875cc09a91cd570ed48403b2c995f
-
Filesize
780KB
MD552b8ff9e93b3ed7d23f1be5737fe9fd6
SHA19dc246cbba5e4e103cbab5642f9bc00375aa01e8
SHA2569fac08b760dbd1ba11421fd0a1f3c4297527752dd31c38f2d16098420a5d8342
SHA5122ebf43f646968a9d9a68a996f2f5522a14b8a04fe732bc3718744d929ee3e53eb367d3ea0521fa29b4b091243cd6ce17a66875cc09a91cd570ed48403b2c995f