Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
7f8b6bfea320f0414a90aca8685e4127.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f8b6bfea320f0414a90aca8685e4127.exe
Resource
win10v2004-20231222-en
General
-
Target
7f8b6bfea320f0414a90aca8685e4127.exe
-
Size
183KB
-
MD5
7f8b6bfea320f0414a90aca8685e4127
-
SHA1
00f57008c94feca19fd903f0bcdbe437aa554ba8
-
SHA256
5ba47c52b9f1029e4f602c4cf170d8aeef5bb435405d8559c0ce94b46b1a55b3
-
SHA512
b48c28b1b9d14909f4ec00620c3803c9b07444a62a21c43ac56a1b60485643abe72bc69e73ba8c7b5ff01f8aab3c0980537fd2b995d6f45a97122e4ae952e0c6
-
SSDEEP
3072:yKdAWkTthrHwvxiIe91s+n3p/5e8jR0cTs/w+VLXKr6vkvs9R8igyQfgEOBeOB03:hwQvXoim363/OG58dyQIpX
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/4856-2-0x0000000010000000-0x0000000010122000-memory.dmp family_gh0strat behavioral2/memory/4856-4-0x0000000010000000-0x0000000010122000-memory.dmp family_gh0strat behavioral2/memory/4856-3-0x0000000010000000-0x0000000010122000-memory.dmp family_gh0strat behavioral2/memory/4856-6-0x0000000010000000-0x0000000010122000-memory.dmp family_gh0strat -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX7A3F0DDD = "C:\\Windows\\XXXXXX7A3F0DDD\\svchsot.exe" 7f8b6bfea320f0414a90aca8685e4127.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Default 7f8b6bfea320f0414a90aca8685e4127.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\XXXXXX7A3F0DDD\svchsot.exe 7f8b6bfea320f0414a90aca8685e4127.exe File opened for modification C:\Windows\XXXXXX7A3F0DDD\svchsot.exe 7f8b6bfea320f0414a90aca8685e4127.exe File created C:\Windows\XXXXXX7A3F0DDD\JH.BAT 7f8b6bfea320f0414a90aca8685e4127.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2388 sc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe 4856 7f8b6bfea320f0414a90aca8685e4127.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4072 4856 7f8b6bfea320f0414a90aca8685e4127.exe 88 PID 4856 wrote to memory of 4072 4856 7f8b6bfea320f0414a90aca8685e4127.exe 88 PID 4856 wrote to memory of 4072 4856 7f8b6bfea320f0414a90aca8685e4127.exe 88 PID 4072 wrote to memory of 4348 4072 cmd.exe 91 PID 4072 wrote to memory of 4348 4072 cmd.exe 91 PID 4072 wrote to memory of 4348 4072 cmd.exe 91 PID 4072 wrote to memory of 2388 4072 cmd.exe 92 PID 4072 wrote to memory of 2388 4072 cmd.exe 92 PID 4072 wrote to memory of 2388 4072 cmd.exe 92 PID 4072 wrote to memory of 3672 4072 cmd.exe 95 PID 4072 wrote to memory of 3672 4072 cmd.exe 95 PID 4072 wrote to memory of 3672 4072 cmd.exe 95 PID 3672 wrote to memory of 2392 3672 net.exe 94 PID 3672 wrote to memory of 2392 3672 net.exe 94 PID 3672 wrote to memory of 2392 3672 net.exe 94 PID 4072 wrote to memory of 2016 4072 cmd.exe 93 PID 4072 wrote to memory of 2016 4072 cmd.exe 93 PID 4072 wrote to memory of 2016 4072 cmd.exe 93 PID 4072 wrote to memory of 2916 4072 cmd.exe 96 PID 4072 wrote to memory of 2916 4072 cmd.exe 96 PID 4072 wrote to memory of 2916 4072 cmd.exe 96 PID 4072 wrote to memory of 4728 4072 cmd.exe 98 PID 4072 wrote to memory of 4728 4072 cmd.exe 98 PID 4072 wrote to memory of 4728 4072 cmd.exe 98 PID 4072 wrote to memory of 3452 4072 cmd.exe 97 PID 4072 wrote to memory of 3452 4072 cmd.exe 97 PID 4072 wrote to memory of 3452 4072 cmd.exe 97 PID 4072 wrote to memory of 4844 4072 cmd.exe 101 PID 4072 wrote to memory of 4844 4072 cmd.exe 101 PID 4072 wrote to memory of 4844 4072 cmd.exe 101 PID 4072 wrote to memory of 4076 4072 cmd.exe 100 PID 4072 wrote to memory of 4076 4072 cmd.exe 100 PID 4072 wrote to memory of 4076 4072 cmd.exe 100 PID 4072 wrote to memory of 5032 4072 cmd.exe 115 PID 4072 wrote to memory of 5032 4072 cmd.exe 115 PID 4072 wrote to memory of 5032 4072 cmd.exe 115 PID 4072 wrote to memory of 3264 4072 cmd.exe 102 PID 4072 wrote to memory of 3264 4072 cmd.exe 102 PID 4072 wrote to memory of 3264 4072 cmd.exe 102 PID 4072 wrote to memory of 4136 4072 cmd.exe 105 PID 4072 wrote to memory of 4136 4072 cmd.exe 105 PID 4072 wrote to memory of 4136 4072 cmd.exe 105 PID 4072 wrote to memory of 4756 4072 cmd.exe 103 PID 4072 wrote to memory of 4756 4072 cmd.exe 103 PID 4072 wrote to memory of 4756 4072 cmd.exe 103 PID 4072 wrote to memory of 3528 4072 cmd.exe 104 PID 4072 wrote to memory of 3528 4072 cmd.exe 104 PID 4072 wrote to memory of 3528 4072 cmd.exe 104 PID 4072 wrote to memory of 4804 4072 cmd.exe 114 PID 4072 wrote to memory of 4804 4072 cmd.exe 114 PID 4072 wrote to memory of 4804 4072 cmd.exe 114 PID 4072 wrote to memory of 3920 4072 cmd.exe 106 PID 4072 wrote to memory of 3920 4072 cmd.exe 106 PID 4072 wrote to memory of 3920 4072 cmd.exe 106 PID 4072 wrote to memory of 3224 4072 cmd.exe 112 PID 4072 wrote to memory of 3224 4072 cmd.exe 112 PID 4072 wrote to memory of 3224 4072 cmd.exe 112 PID 4072 wrote to memory of 4960 4072 cmd.exe 107 PID 4072 wrote to memory of 4960 4072 cmd.exe 107 PID 4072 wrote to memory of 4960 4072 cmd.exe 107 PID 4072 wrote to memory of 1624 4072 cmd.exe 111 PID 4072 wrote to memory of 1624 4072 cmd.exe 111 PID 4072 wrote to memory of 1624 4072 cmd.exe 111 PID 4072 wrote to memory of 4356 4072 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f8b6bfea320f0414a90aca8685e4127.exe"C:\Users\Admin\AppData\Local\Temp\7f8b6bfea320f0414a90aca8685e4127.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\XXXXXX7A3F0DDD\JH.BAT2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn * /f3⤵PID:4348
-
-
C:\Windows\SysWOW64\sc.exesc config Schedule start= auto3⤵
- Launches sc.exe
PID:2388
-
-
C:\Windows\SysWOW64\at.exeAt 0:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:2016
-
-
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"3⤵
- Suspicious use of WriteProcessMemory
PID:3672
-
-
C:\Windows\SysWOW64\at.exeAt 1:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:2916
-
-
C:\Windows\SysWOW64\at.exeAt 3:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:3452
-
-
C:\Windows\SysWOW64\at.exeAt 2:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4728
-
-
C:\Windows\SysWOW64\at.exeAt 5:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4076
-
-
C:\Windows\SysWOW64\at.exeAt 4:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4844
-
-
C:\Windows\SysWOW64\at.exeAt 7:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:3264
-
-
C:\Windows\SysWOW64\at.exeAt 9:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4756
-
-
C:\Windows\SysWOW64\at.exeAt 10:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:3528
-
-
C:\Windows\SysWOW64\at.exeAt 8:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4136
-
-
C:\Windows\SysWOW64\at.exeAt 12:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:3920
-
-
C:\Windows\SysWOW64\at.exeAt 14:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4960
-
-
C:\Windows\SysWOW64\at.exeAt 16:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4356
-
-
C:\Windows\SysWOW64\at.exeAt 18:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:5072
-
-
C:\Windows\SysWOW64\at.exeAt 17:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:2248
-
-
C:\Windows\SysWOW64\at.exeAt 15:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:1624
-
-
C:\Windows\SysWOW64\at.exeAt 13:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:3224
-
-
C:\Windows\SysWOW64\at.exeAt 19:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:1608
-
-
C:\Windows\SysWOW64\at.exeAt 11:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4804
-
-
C:\Windows\SysWOW64\at.exeAt 6:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:5032
-
-
C:\Windows\SysWOW64\at.exeAt 20:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:2632
-
-
C:\Windows\SysWOW64\at.exeAt 21:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:1748
-
-
C:\Windows\SysWOW64\at.exeAt 22:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:5044
-
-
C:\Windows\SysWOW64\at.exeAt 23:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:2240
-
-
C:\Windows\SysWOW64\at.exeAt 24:00 C:\Windows\XXXXXX7A3F0DDD\svchsot.exe3⤵PID:4412
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"1⤵PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD534f391f0fecabdb0b1c7dcf94b63d9bd
SHA1755744fcbae194ee4c2543be99bde9ad9eb4edeb
SHA2564895989db870b44359e792deb72fcb91040cf221706b9afee877ac0d7a632315
SHA512be0434caf6367fc3df4acffb129a10767b6abea1e9fbfcedf8bab754afc81db5b700ae0ef22a55b35e1e0e309ffa4ca3a5862deedc9897bdb54c32da82035507