Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
11/12/2023, 06:03
General
-
Target
df1cbce0169bf74376f9c777c704a5128ec37966359c8ffad8d8d820f876a78c.exe
-
Size
1.2MB
-
MD5
ee314caa19f51ff2010bf31bd89c0d45
-
SHA1
54579d7258c887b2ffbcc963d0f090b9fec91931
-
SHA256
df1cbce0169bf74376f9c777c704a5128ec37966359c8ffad8d8d820f876a78c
-
SHA512
64bc4978c4e09cfec6aa8166d20db5e11d83b086c7c3ba7727ac1d1c7174c7b3fe9b717f536d28c47e58023370389e03f6ec34b40f13002cd93f7b0cf5fe52ad
-
SSDEEP
24576:5068q4ii3ZfYGKGKrBJXkvkrcwlyDghKFroghjeezMjjm6JK0Sx0p0t:Otr339YGKGKv9czgh0vaeWvJK0gH
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df1cbce0169bf74376f9c777c704a5128ec37966359c8ffad8d8d820f876a78c.exe"C:\Users\Admin\AppData\Local\Temp\df1cbce0169bf74376f9c777c704a5128ec37966359c8ffad8d8d820f876a78c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\DTLSoft\cellinst.exeC:\DTLSoft/cellinst.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5921e902873061cf84db0f51cfba1a55e
SHA11b3565c7b4450e3c7a66339c81a565be66ca6da7
SHA2564032442d59974bb4103e936c11cb66ff75f416f7cf85ec4ad3df26aa1438e4c9
SHA51282e57f7f07146aedc80f5c92f39e4e7bd6611a680c727475c3d17658c7c768a4f22a49f8a56f4df0d31f7d864857ac6e7821f037dd3d04948cee63c130d13053
-
Filesize
143KB
MD5d9c7fbb5aebff80dcc4335d272e5b151
SHA1b7fef8202dd4315c5d856ebc0cde7ea18aaf77d0
SHA2566699f04b2c092ad66b0cf1ddf2f0c0178fe8f40d61fde353b8d90caee6745465
SHA512f9114a353b219a40da494cd3a1c2e03aa2ae8b3744baf2c99cc03ecd04e7fb44aa76a7e276bf62240d543ba8e755ead175315bdb1c1f351bf52a9302314a13ef
-
Filesize
353KB
MD5d70ec4e5e788651ea5a0d694962e603f
SHA118184070d81f1afb6329c4fd5167fc53e283935a
SHA256813829bd350b8aff8dbc058cb90a5c47d02712d16f31a6a9d075dd27ceee0c1c
SHA512720986ebb0fdef0a52913727ba9e7ae75b84c9b901f383d9dd90e589366f5cca3461a48d7cb6493f5c6fc7e6ea69aac6dc5156ffef49e2dcff58ec81b6f10856
-
Filesize
544KB
MD58efd25671f617473559ca9ae2254af58
SHA1f77806256e7fb7555651c78e6a9a8ce534c7a738
SHA256f4e56ad9e9a0304eaa3084a642a61f668d17365c7a6935019234c65568c2a2cc
SHA512117219dcf7b5fe1f221ec7509ec3c9ed3b2f2725870c7f753782bcb5960ef256b72b85e4b0564a0222c71bb602eabb29e11454ae41ba1c5b86bfd75c76beaac1
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
8KB
-
Filesize
3.9MB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB