Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
03/02/2024, 18:32
General
-
Target
286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d.exe
-
Size
114KB
-
MD5
ca4bb52547f96a438f4ac818b49b4390
-
SHA1
345541c809c323974873c5186db4f9b6e1af28b4
-
SHA256
286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d
-
SHA512
77249debd1328f5a7f02017c99940cdc802045bf39cd149b034c02aad4084a828d3ed9b398ccfd832a6bddb0759620f960f6e4c22e1c9617d4e9c9a3d062e269
-
SSDEEP
3072:pNDmF0ETdzsCeymmiat8f44IwMIGakllF9UIi/N3kmdj:pNDmeWhsVlM8fMwMVUQmd
Score
10/10
Malware Config
Extracted
Family
gh0strat
C2
125.112.25.134
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d.exe"C:\Users\Admin\AppData\Local\Temp\286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB
-
Filesize
84KB
-
Filesize
404KB