Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe
Resource
win10v2004-20240221-en
General
-
Target
679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe
-
Size
4.6MB
-
MD5
64d34dbd3c392f7aee145775fdf5ac5e
-
SHA1
7e2dcb57df470e14faa23be53b9e0848b833f567
-
SHA256
679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3
-
SHA512
0288981544361fc1340a3aba4a207a6b014372579cb76ab8ff4d052336a6a57baeaef77ea2cf87bb8f10c1e78d3cbb725977cf3aed21f19370deabe7e58548dd
-
SSDEEP
49152:sYREXSVMDi3gKbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PL:12SVMD8gKbXsPN5kiQaZ56
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000231f0-5.dat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240598125.bat" look2.exe -
Executes dropped EXE 3 IoCs
pid Process 4552 look2.exe 2456 HD_679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 4780 svchcst.exe -
Loads dropped DLL 3 IoCs
pid Process 4552 look2.exe 3316 svchost.exe 4780 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240598125.bat look2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 836 wrote to memory of 4552 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 86 PID 836 wrote to memory of 4552 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 86 PID 836 wrote to memory of 4552 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 86 PID 836 wrote to memory of 2456 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 90 PID 836 wrote to memory of 2456 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 90 PID 836 wrote to memory of 2456 836 679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe 90 PID 3316 wrote to memory of 4780 3316 svchost.exe 93 PID 3316 wrote to memory of 4780 3316 svchost.exe 93 PID 3316 wrote to memory of 4780 3316 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe"C:\Users\Admin\AppData\Local\Temp\679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4552
-
-
C:\Users\Admin\AppData\Local\Temp\HD_679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exeC:\Users\Admin\AppData\Local\Temp\HD_679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe2⤵
- Executes dropped EXE
PID:2456
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:972
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240598125.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_679e02eeeeae9ac957cbb2339a3ac7001e8f6bdcead1e58053f874beaa235fa3.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
1.6MB
MD5e03ba42144790c8015ab41ff24ab8e49
SHA1ffea9f123323b97febfb52486fc26e4def282314
SHA25662b20356f2b5b974ca3f1724d5cc0d872f3d8711c688a0148c8c0372490830cd
SHA51292e44e9674bb2445e0c0e37516bfa81fc1066539ab8176a92874c5d23af6c3499d419000f1ffa9764dcda83a08f174ab52543e251e6ceb7a54a4207acdd1fd52
-
Filesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
Filesize
51KB
MD54bde745b0d0e003516ef4e47b4bb26b1
SHA1b3b203d5be794abb2eac436d4d900b8e9bab5c83
SHA256a06cd283c43b9c23a9a3a59d9cadac398e64a4ed58a857e153ac42ceada27901
SHA512d255b803ea29517486f39f196891df4b402025959dad39ec70aec755a4ea4f44f66445319ac21621cfb571fa570526217e42722931de8d97185372f3b6dae0a3
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641