Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe
Resource
win7-20231020-en
General
-
Target
cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe
-
Size
6.3MB
-
MD5
5faee14c701f0626673b356c227c0fc2
-
SHA1
176ad9ea383d9d911fad5a8124292dbb0a6a3bd6
-
SHA256
cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244
-
SHA512
f92566216b8d547fdc9396e411748482929bd86bd1b0da289639ffbaed7b71cc956860d89913d5dee452cf6d167d661f19d78e2c04bc7f4df9a62e84667afba4
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNvI:QHPkVOBTKw
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1692-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/3776-11-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/1692-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/3776-11-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys sainbox.kx -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.kx -
Executes dropped EXE 2 IoCs
pid Process 3776 sainbox.kx 1392 sainbox.kx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sainbox.kx cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe File opened for modification C:\Windows\SysWOW64\sainbox.kx cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sainbox.kx Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sainbox.kx Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sainbox.kx -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4756 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1392 sainbox.kx -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1692 cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe Token: SeLoadDriverPrivilege 1392 sainbox.kx Token: 33 1392 sainbox.kx Token: SeIncBasePriorityPrivilege 1392 sainbox.kx Token: 33 1392 sainbox.kx Token: SeIncBasePriorityPrivilege 1392 sainbox.kx -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1692 wrote to memory of 4072 1692 cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe 93 PID 1692 wrote to memory of 4072 1692 cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe 93 PID 1692 wrote to memory of 4072 1692 cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe 93 PID 4072 wrote to memory of 4756 4072 cmd.exe 95 PID 4072 wrote to memory of 4756 4072 cmd.exe 95 PID 4072 wrote to memory of 4756 4072 cmd.exe 95 PID 3776 wrote to memory of 1392 3776 sainbox.kx 96 PID 3776 wrote to memory of 1392 3776 sainbox.kx 96 PID 3776 wrote to memory of 1392 3776 sainbox.kx 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe"C:\Users\Admin\AppData\Local\Temp\cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CDF8FA~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:4756
-
-
-
C:\Windows\SysWOW64\sainbox.kxC:\Windows\SysWOW64\sainbox.kx -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\sainbox.kxC:\Windows\SysWOW64\sainbox.kx -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.3MB
MD55faee14c701f0626673b356c227c0fc2
SHA1176ad9ea383d9d911fad5a8124292dbb0a6a3bd6
SHA256cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244
SHA512f92566216b8d547fdc9396e411748482929bd86bd1b0da289639ffbaed7b71cc956860d89913d5dee452cf6d167d661f19d78e2c04bc7f4df9a62e84667afba4
-
Filesize
6.3MB
MD55faee14c701f0626673b356c227c0fc2
SHA1176ad9ea383d9d911fad5a8124292dbb0a6a3bd6
SHA256cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244
SHA512f92566216b8d547fdc9396e411748482929bd86bd1b0da289639ffbaed7b71cc956860d89913d5dee452cf6d167d661f19d78e2c04bc7f4df9a62e84667afba4
-
Filesize
6.3MB
MD55faee14c701f0626673b356c227c0fc2
SHA1176ad9ea383d9d911fad5a8124292dbb0a6a3bd6
SHA256cdf8fa2d4ee0ac723e3f9479a054354643a551d17e92e6ed29f2183b4a0c6244
SHA512f92566216b8d547fdc9396e411748482929bd86bd1b0da289639ffbaed7b71cc956860d89913d5dee452cf6d167d661f19d78e2c04bc7f4df9a62e84667afba4