Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 12:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ffa0c7b4481628c4a0e37a7d21a0ea3.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
1ffa0c7b4481628c4a0e37a7d21a0ea3.exe
-
Size
358KB
-
MD5
1ffa0c7b4481628c4a0e37a7d21a0ea3
-
SHA1
b5f23826c94a73e2a0e7ff16aeb072c221b74092
-
SHA256
e19fe20c97c4a4fcf65738919d453c2fcd7855dbb5e60f5fefa46ee6ea0002ef
-
SHA512
5e8b6292dc0e6168a8899e61ad3bc322311cd873f06a2fb4e81a7c9c99c8478b2165301701588bdddf7023d909c97e11bb9fff21ed08874c8c65a8ed366447c0
-
SSDEEP
6144:/qKne2Ko9cK2OHnV7D2djek72aTALaFIm85ZDOFBjb/8o05NYXafC2IxFRD:v78gnV/2okya+bFOfv8t5NY12GFF
Malware Config
Signatures
-
Gh0st RAT payload 16 IoCs
resource yara_rule behavioral1/memory/2084-4-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2084-5-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2084-7-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2704-17-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2704-18-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2704-16-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2704-15-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2084-3-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2972-24-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2972-26-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2876-33-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2876-35-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2972-36-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2876-37-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2876-38-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2876-39-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
pid Process 2704 Terms.EXE.exe 2972 Terms.EXE.exe 2876 Terms.EXE.exe -
resource yara_rule behavioral1/memory/2084-0-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2084-4-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2084-5-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2084-7-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2704-12-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2704-17-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2704-18-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2704-16-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2704-15-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2084-3-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2972-24-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2972-26-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2876-33-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2876-35-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2972-36-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2876-37-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2876-38-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2876-39-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Terms.EXE.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Terms.EXE.exe 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe File opened for modification C:\Windows\Terms.EXE.exe 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2728 2972 WerFault.exe 29 -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Terms.EXE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Terms.EXE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Terms.EXE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Terms.EXE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Terms.EXE.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34}\WpadDecisionReason = "1" Terms.EXE.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34}\WpadNetworkName = "Network 3" Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-07-d8-00-e2-28\WpadDecisionReason = "1" Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34} Terms.EXE.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-07-d8-00-e2-28 Terms.EXE.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Terms.EXE.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-07-d8-00-e2-28\WpadDecisionTime = 50b75345ba37da01 Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-07-d8-00-e2-28\WpadDecision = "0" Terms.EXE.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Terms.EXE.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.EXE.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Terms.EXE.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34}\WpadDecision = "0" Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Terms.EXE.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34}\WpadDecisionTime = 50b75345ba37da01 Terms.EXE.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6C3E4867-A689-4F6B-9966-8B840D350C34}\fe-07-d8-00-e2-28 Terms.EXE.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Terms.EXE.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2084 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe Token: SeDebugPrivilege 2704 Terms.EXE.exe Token: SeDebugPrivilege 2972 Terms.EXE.exe Token: SeDebugPrivilege 2972 Terms.EXE.exe Token: SeDebugPrivilege 2876 Terms.EXE.exe Token: SeDebugPrivilege 2876 Terms.EXE.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2704 2084 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe 28 PID 2084 wrote to memory of 2704 2084 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe 28 PID 2084 wrote to memory of 2704 2084 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe 28 PID 2084 wrote to memory of 2704 2084 1ffa0c7b4481628c4a0e37a7d21a0ea3.exe 28 PID 2972 wrote to memory of 2876 2972 Terms.EXE.exe 31 PID 2972 wrote to memory of 2876 2972 Terms.EXE.exe 31 PID 2972 wrote to memory of 2876 2972 Terms.EXE.exe 31 PID 2972 wrote to memory of 2876 2972 Terms.EXE.exe 31 PID 2972 wrote to memory of 2728 2972 Terms.EXE.exe 30 PID 2972 wrote to memory of 2728 2972 Terms.EXE.exe 30 PID 2972 wrote to memory of 2728 2972 Terms.EXE.exe 30 PID 2972 wrote to memory of 2728 2972 Terms.EXE.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ffa0c7b4481628c4a0e37a7d21a0ea3.exe"C:\Users\Admin\AppData\Local\Temp\1ffa0c7b4481628c4a0e37a7d21a0ea3.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\Terms.EXE.exe"C:\Windows\Terms.EXE.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\Terms.EXE.exeC:\Windows\Terms.EXE.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 3402⤵
- Program crash
PID:2728
-
-
C:\Windows\Terms.EXE.exeC:\Windows\Terms.EXE.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2876
-