Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
1eaae465bda927c1893a5744301cde9b.exe
Resource
win7-20240221-en
General
-
Target
1eaae465bda927c1893a5744301cde9b.exe
-
Size
844KB
-
MD5
1eaae465bda927c1893a5744301cde9b
-
SHA1
6d5f62d54dda0a61f5f7a8b2cbbff86cf2ac2ae9
-
SHA256
c297e02f804f7c95762ada2efb98866c6a509db4ace8bf06f95af3a41c8e702c
-
SHA512
76a20258f1c43f620ad8f66916192c1a33c48ec2f4594107ad987088da3a500bff5ea5d3cd3954457aee09b2c44c36530cf00518398caf0c756f48b7b0aa7819
-
SSDEEP
12288:VCQjgAtAHM+vetZxF5EWry8AJGy0/X+tMLNjG6pgt6cBUl48ij/ePdEkHwicLMdB:V5ZWs+OZVEWry8AFaNj5E6wUmx0pp
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
resource yara_rule behavioral1/memory/3036-21-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3036-22-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2920-41-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2920-40-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2448-62-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2448-63-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2448-64-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
pid Process 3036 csrss.exe 2920 Jufrxnb.exe 2520 Jufrxnb.exe 2448 Jufrxnb.exe -
Loads dropped DLL 3 IoCs
pid Process 3036 csrss.exe 3036 csrss.exe 2520 Jufrxnb.exe -
resource yara_rule behavioral1/memory/3036-17-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3036-21-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3036-22-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2920-37-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2920-41-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2920-40-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2448-62-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2448-63-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2448-64-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Jufrxnb.exe File opened (read-only) \??\K: Jufrxnb.exe File opened (read-only) \??\L: Jufrxnb.exe File opened (read-only) \??\P: Jufrxnb.exe File opened (read-only) \??\T: Jufrxnb.exe File opened (read-only) \??\Z: Jufrxnb.exe File opened (read-only) \??\I: Jufrxnb.exe File opened (read-only) \??\M: Jufrxnb.exe File opened (read-only) \??\O: Jufrxnb.exe File opened (read-only) \??\Q: Jufrxnb.exe File opened (read-only) \??\N: Jufrxnb.exe File opened (read-only) \??\S: Jufrxnb.exe File opened (read-only) \??\V: Jufrxnb.exe File opened (read-only) \??\X: Jufrxnb.exe File opened (read-only) \??\B: Jufrxnb.exe File opened (read-only) \??\E: Jufrxnb.exe File opened (read-only) \??\H: Jufrxnb.exe File opened (read-only) \??\J: Jufrxnb.exe File opened (read-only) \??\Y: Jufrxnb.exe File opened (read-only) \??\R: Jufrxnb.exe File opened (read-only) \??\U: Jufrxnb.exe File opened (read-only) \??\W: Jufrxnb.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe csrss.exe File opened for modification C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe csrss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Jufrxnb.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Jufrxnb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Jufrxnb.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Jufrxnb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Jufrxnb.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jufrxnb.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Jufrxnb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jufrxnb.exe Key created \REGISTRY\USER\.DEFAULT\Software Jufrxnb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Jufrxnb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Jufrxnb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Jufrxnb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2448 Jufrxnb.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3036 csrss.exe Token: SeDebugPrivilege 2920 Jufrxnb.exe Token: SeDebugPrivilege 2520 Jufrxnb.exe Token: SeDebugPrivilege 2520 Jufrxnb.exe Token: SeDebugPrivilege 2448 Jufrxnb.exe Token: SeDebugPrivilege 2448 Jufrxnb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3036 2924 1eaae465bda927c1893a5744301cde9b.exe 28 PID 2924 wrote to memory of 3036 2924 1eaae465bda927c1893a5744301cde9b.exe 28 PID 2924 wrote to memory of 3036 2924 1eaae465bda927c1893a5744301cde9b.exe 28 PID 2924 wrote to memory of 3036 2924 1eaae465bda927c1893a5744301cde9b.exe 28 PID 3036 wrote to memory of 2920 3036 csrss.exe 29 PID 3036 wrote to memory of 2920 3036 csrss.exe 29 PID 3036 wrote to memory of 2920 3036 csrss.exe 29 PID 3036 wrote to memory of 2920 3036 csrss.exe 29 PID 2520 wrote to memory of 2448 2520 Jufrxnb.exe 31 PID 2520 wrote to memory of 2448 2520 Jufrxnb.exe 31 PID 2520 wrote to memory of 2448 2520 Jufrxnb.exe 31 PID 2520 wrote to memory of 2448 2520 Jufrxnb.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eaae465bda927c1893a5744301cde9b.exe"C:\Users\Admin\AppData\Local\Temp\1eaae465bda927c1893a5744301cde9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\csrss.exe"C:\Users\csrss.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-