Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:23
Behavioral task
behavioral1
Sample
2463996b1de747ac9321d4e4a79d03ef.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2463996b1de747ac9321d4e4a79d03ef.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
2463996b1de747ac9321d4e4a79d03ef.exe
-
Size
204KB
-
MD5
2463996b1de747ac9321d4e4a79d03ef
-
SHA1
eeee1f7862a0b17ef64ad084c6edceb8d3d360af
-
SHA256
74bf0537d435c1f45ca771661e008a344fab98a69ed7350a97c4cb3f44bdf41e
-
SHA512
0956c2c6942a6edd893cf2d24b2ba662806d9f157d6683d98d4b26af78c594728d7237a253051a72e9013828dea32a117401865d2c084fbe676c7f2c844ac932
-
SSDEEP
6144:kGzRxSVtp0l6whGfsKR+zkBpTaa5tJH7hL:Xt0VPFfsKAkrbPl7hL
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2312-9-0x0000000000400000-0x00000000004F0000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2312 (null)0.exe -
resource yara_rule behavioral1/memory/2324-0-0x0000000000400000-0x00000000004F0000-memory.dmp upx behavioral1/memory/2312-9-0x0000000000400000-0x00000000004F0000-memory.dmp upx behavioral1/files/0x000b000000015d50-5.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2463996b1de747ac9321d4e4a79d03ef.exe" 2463996b1de747ac9321d4e4a79d03ef.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created \??\c:\Windows\BJ.exe 2463996b1de747ac9321d4e4a79d03ef.exe File opened for modification \??\c:\Windows\BJ.exe 2463996b1de747ac9321d4e4a79d03ef.exe File created \??\c:\Windows\(null)0.exe 2463996b1de747ac9321d4e4a79d03ef.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2312 2324 2463996b1de747ac9321d4e4a79d03ef.exe 14 PID 2324 wrote to memory of 2312 2324 2463996b1de747ac9321d4e4a79d03ef.exe 14 PID 2324 wrote to memory of 2312 2324 2463996b1de747ac9321d4e4a79d03ef.exe 14 PID 2324 wrote to memory of 2312 2324 2463996b1de747ac9321d4e4a79d03ef.exe 14
Processes
-
\??\c:\Windows\(null)0.exec:\Windows\(null)0.exe1⤵
- Executes dropped EXE
PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2463996b1de747ac9321d4e4a79d03ef.exe"C:\Users\Admin\AppData\Local\Temp\2463996b1de747ac9321d4e4a79d03ef.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324