Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 14:26
General
-
Target
a107d33da31fc307867b2da29824f018476648f24699e3a1c25f257b0e8f7796.exe
-
Size
1.8MB
-
MD5
f87a25f3eb44b81c78cfdfabbe3ce541
-
SHA1
8b276dbbf24b0c34022abae23b718652c88dee44
-
SHA256
a107d33da31fc307867b2da29824f018476648f24699e3a1c25f257b0e8f7796
-
SHA512
e9ce797c03f2bcabb9c3cfe5a0d50d276b386fff3e1d768cb8e9d32f72361ab5b83f7b71153182a98b9f995be3ab1c8fff88e82fa734cf372a74ac5fd5ce02b9
-
SSDEEP
49152:E1mioKjZ/A5GrfHZ+SucajTTgwjyMVO11Awf5REAmqshf+gG3NQDE0urag:EmKA5Grf5+6ajTTgwjyMU16wYAmqBgG3
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Modifies RDP port number used by Windows 1 TTPs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a107d33da31fc307867b2da29824f018476648f24699e3a1c25f257b0e8f7796.exe"C:\Users\Admin\AppData\Local\Temp\a107d33da31fc307867b2da29824f018476648f24699e3a1c25f257b0e8f7796.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
312KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB