Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
1032a3ed090f9abba2c1cba5f8412764.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
1032a3ed090f9abba2c1cba5f8412764.exe
-
Size
143KB
-
MD5
1032a3ed090f9abba2c1cba5f8412764
-
SHA1
fb287a0a8a222221a9042f0b8ae52174b09ebb71
-
SHA256
3a5d187a32e724419e9f09e614e24d2d16a68bfe30dff50c377a1e9286d219a9
-
SHA512
652a75b4eae898980a643e09989869e5b3552f326df3582966f057dd1d9856915a198bcaac458b1f7766520eb2698f040964dc10478a5a65195b157cf0f70b15
-
SSDEEP
3072:C69iSZOmD27rRavfCCY8feFgtV4dfFO5pctyhUeqovd3B3E:C/Sc1oykcFu3hUeqoJB0
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4780-2-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat behavioral2/files/0x000300000002276d-3.dat family_gh0strat behavioral2/files/0x000700000001e7de-12.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 3284 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 4780 1032a3ed090f9abba2c1cba5f8412764.exe 3284 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\123.jpg 1032a3ed090f9abba2c1cba5f8412764.exe File created C:\Windows\123.jpg 1032a3ed090f9abba2c1cba5f8412764.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 1032a3ed090f9abba2c1cba5f8412764.exe 4780 1032a3ed090f9abba2c1cba5f8412764.exe 4780 1032a3ed090f9abba2c1cba5f8412764.exe 4780 1032a3ed090f9abba2c1cba5f8412764.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe 3284 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeBackupPrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe Token: SeRestorePrivilege 4780 1032a3ed090f9abba2c1cba5f8412764.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe"C:\Users\Admin\AppData\Local\Temp\1032a3ed090f9abba2c1cba5f8412764.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5ca3d84abd2632b1575c754b4404ec695
SHA16657872f3b828024bd2bee272cbcf34448e0ca53
SHA256cb6e3f4a37bd4dde1ad468cc588f5d30a58ba2f91851ddfea4a5b96c06b3344f
SHA512f894f8feca666629a05334f22e77b96137160be867e6250dca6adbe08e845f708506792afe735e4b890b87402b26065f4759b2a111d62856e008a670646f1978
-
Filesize
84B
MD5aa67349aedc4d7839fc68db94638143f
SHA1e49542b29f061106a6d523e9f0f7e75f41793ebd
SHA256faabb28af64d10b86d2fe776e173825e91cfc9741aa93b73fba8898830dbb582
SHA512bda6d3363c96d8b9deccad6e3bd4d3d9e4983ef05442be25cee9e880acab0e1f7a7731283447946e92986b67a5ca2de84ad9c0f742d0525b6667f3da04ef9ddc
-
Filesize
10.4MB
MD5780891b3fb58a00290bd2208941e5c90
SHA144c9406f508a58ba9c7217c9ed2928c373b27c2a
SHA256cecf7d750a85da5bc85bd4d5cafe1ff7b2c3d87d444b39a6e1550e52fc968eaf
SHA512e680854803b20084b511a42389455b36e97c9e6a091f89351d26f0182e36ae519cae7ccac96f77cc1b82f9d67492e7dbcac7d7e3a75de388f8102ddaa3703fbd
