Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/05/2024, 15:02

240501-sewm7ahf3v 10

19/03/2024, 11:01

240319-m4tl8sad46 10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 11:01

General

  • Target

    a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe

  • Size

    1.0MB

  • MD5

    4531c46b0844e49db3b482ab0a8aaa99

  • SHA1

    8bafe779083ca8a8c1edd9dc7995b1aaec75ccdb

  • SHA256

    a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005

  • SHA512

    a9671f57c624d73266f36449bada1be9fe51e138a35d941ec725f628584fb72961ca5b6ea1e3c943baa3e0f492a56859fe8dd661c7d61309fa9e5dd0c96f0c55

  • SSDEEP

    12288:M+UsITPsJnAyGnAMmyZE+qwc1/ConIsrwk9:M+fITPTywNi+qksi

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe
    "C:\Users\Admin\AppData\Local\Temp\a0d89a8cb7cc1539cae2e1c6e7dee4835506179deab6e5183000ffe30e5f9005.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\windows\Ogqgwg.exe
      "C:\windows\Ogqgwg.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Ogqgwg.exe

    Filesize

    519KB

    MD5

    641d0092c70bfb2d4d2a2b1c773463a6

    SHA1

    92398f8365901d11559fe8e426fb9a70281689b3

    SHA256

    a074fcdc95dd153a5f2c5dc06461142fb3aa2faf43a54d3cb7873b91c3046fa5

    SHA512

    644e381bb90ba8162bd949acc34c736ab26a0f68a0d9d5f59379a069083e44fbc8dec310f4a28afb621ba5dc588e5c577af0f8764b61ac5251efc858bf57e2f4

  • C:\Windows\Ogqgwg.exe

    Filesize

    121KB

    MD5

    a7098f496513ba8a16f2c3892aa20a34

    SHA1

    88979a6c62b39db36d8058b0d2ec1e4f2bc6963b

    SHA256

    4b4053edf5bd05aa6bf7585b097db52d166dfb7be25eabe4c6a050f91af56f9c

    SHA512

    8cf1df4b2c56ae671cb0d4b6ca49377105b310f2f0d0a2eec27d987c84670fb741d4c9ad6d2da721b634f148587eb80d400ab6200c84e64050b8638dcf19b1e2

  • C:\Windows\SysWOW64\ini.ini

    Filesize

    19B

    MD5

    fe9af7587d65300338177538aa72f924

    SHA1

    c8ae231d3ae13f9db8b9f16e188e951e7cb76377

    SHA256

    556243e27a369fbdff1ecfb413b7540f1eb4e6becba03b76d221443b0d022351

    SHA512

    3bffe70c5daea4d6be501278be067bbc02e7ac211fef33629b5447ef498d49af7cbe25f994e33c2835bd9963749c07edc789fddd918e1c7739b77422ff57cf3e

  • C:\windows\Ogqgwg.exe

    Filesize

    98KB

    MD5

    a8bcd2c87c2c3bb4618354b9dbe7e0e0

    SHA1

    54ac23ae069bbfa53501d648e18aa1a92b731af3

    SHA256

    d57160366c9d4f701af31b50041e0e150926a099e315af8bbd4ec504291baec9

    SHA512

    1288e7feca9b763e13d3c7de5ada5944f047f54b0932dc18496137a9642f354cec7a31561906d97fd2ff7082fac57a52d06f34a759ab4fb8b1b588c61a182609

  • memory/3308-3-0x0000000010000000-0x000000001008E000-memory.dmp

    Filesize

    568KB