Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 09:57

General

  • Target

    7f8b6bfea320f0414a90aca8685e4127.exe

  • Size

    183KB

  • MD5

    7f8b6bfea320f0414a90aca8685e4127

  • SHA1

    00f57008c94feca19fd903f0bcdbe437aa554ba8

  • SHA256

    5ba47c52b9f1029e4f602c4cf170d8aeef5bb435405d8559c0ce94b46b1a55b3

  • SHA512

    b48c28b1b9d14909f4ec00620c3803c9b07444a62a21c43ac56a1b60485643abe72bc69e73ba8c7b5ff01f8aab3c0980537fd2b995d6f45a97122e4ae952e0c6

  • SSDEEP

    3072:yKdAWkTthrHwvxiIe91s+n3p/5e8jR0cTs/w+VLXKr6vkvs9R8igyQfgEOBeOB03:hwQvXoim363/OG58dyQIpX

Malware Config

Signatures

  • Gh0st RAT payload 4 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f8b6bfea320f0414a90aca8685e4127.exe
    "C:\Users\Admin\AppData\Local\Temp\7f8b6bfea320f0414a90aca8685e4127.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\XXXXXX7A3F0DDD\JH.BAT
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn * /f
        3⤵
          PID:4348
        • C:\Windows\SysWOW64\sc.exe
          sc config Schedule start= auto
          3⤵
          • Launches sc.exe
          PID:2388
        • C:\Windows\SysWOW64\at.exe
          At 0:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
          3⤵
            PID:2016
          • C:\Windows\SysWOW64\net.exe
            net start "Task Scheduler"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3672
          • C:\Windows\SysWOW64\at.exe
            At 1:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
            3⤵
              PID:2916
            • C:\Windows\SysWOW64\at.exe
              At 3:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
              3⤵
                PID:3452
              • C:\Windows\SysWOW64\at.exe
                At 2:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                3⤵
                  PID:4728
                • C:\Windows\SysWOW64\at.exe
                  At 5:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                  3⤵
                    PID:4076
                  • C:\Windows\SysWOW64\at.exe
                    At 4:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                    3⤵
                      PID:4844
                    • C:\Windows\SysWOW64\at.exe
                      At 7:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                      3⤵
                        PID:3264
                      • C:\Windows\SysWOW64\at.exe
                        At 9:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                        3⤵
                          PID:4756
                        • C:\Windows\SysWOW64\at.exe
                          At 10:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                          3⤵
                            PID:3528
                          • C:\Windows\SysWOW64\at.exe
                            At 8:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                            3⤵
                              PID:4136
                            • C:\Windows\SysWOW64\at.exe
                              At 12:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                              3⤵
                                PID:3920
                              • C:\Windows\SysWOW64\at.exe
                                At 14:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                3⤵
                                  PID:4960
                                • C:\Windows\SysWOW64\at.exe
                                  At 16:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                  3⤵
                                    PID:4356
                                  • C:\Windows\SysWOW64\at.exe
                                    At 18:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                    3⤵
                                      PID:5072
                                    • C:\Windows\SysWOW64\at.exe
                                      At 17:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                      3⤵
                                        PID:2248
                                      • C:\Windows\SysWOW64\at.exe
                                        At 15:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                        3⤵
                                          PID:1624
                                        • C:\Windows\SysWOW64\at.exe
                                          At 13:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                          3⤵
                                            PID:3224
                                          • C:\Windows\SysWOW64\at.exe
                                            At 19:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                            3⤵
                                              PID:1608
                                            • C:\Windows\SysWOW64\at.exe
                                              At 11:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                              3⤵
                                                PID:4804
                                              • C:\Windows\SysWOW64\at.exe
                                                At 6:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                3⤵
                                                  PID:5032
                                                • C:\Windows\SysWOW64\at.exe
                                                  At 20:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                  3⤵
                                                    PID:2632
                                                  • C:\Windows\SysWOW64\at.exe
                                                    At 21:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                    3⤵
                                                      PID:1748
                                                    • C:\Windows\SysWOW64\at.exe
                                                      At 22:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                      3⤵
                                                        PID:5044
                                                      • C:\Windows\SysWOW64\at.exe
                                                        At 23:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                        3⤵
                                                          PID:2240
                                                        • C:\Windows\SysWOW64\at.exe
                                                          At 24:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe
                                                          3⤵
                                                            PID:4412
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 start "Task Scheduler"
                                                        1⤵
                                                          PID:2392

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Windows\XXXXXX7A3F0DDD\JH.BAT

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          34f391f0fecabdb0b1c7dcf94b63d9bd

                                                          SHA1

                                                          755744fcbae194ee4c2543be99bde9ad9eb4edeb

                                                          SHA256

                                                          4895989db870b44359e792deb72fcb91040cf221706b9afee877ac0d7a632315

                                                          SHA512

                                                          be0434caf6367fc3df4acffb129a10767b6abea1e9fbfcedf8bab754afc81db5b700ae0ef22a55b35e1e0e309ffa4ca3a5862deedc9897bdb54c32da82035507

                                                        • memory/4856-0-0x0000000010000000-0x0000000010122000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4856-2-0x0000000010000000-0x0000000010122000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4856-4-0x0000000010000000-0x0000000010122000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4856-3-0x0000000010000000-0x0000000010122000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4856-6-0x0000000010000000-0x0000000010122000-memory.dmp

                                                          Filesize

                                                          1.1MB