Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
Resource
win10v2004-20240611-en
General
-
Target
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
-
Size
1.6MB
-
MD5
1fcea600b31caa6afe38f274dbc26fdd
-
SHA1
5f2306ae3943c7a73faef47660441d6ca071e13b
-
SHA256
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114
-
SHA512
e29506855d461eeb3db0687862386df8eb9d2a60bd3414f1cba955a802a139254cbac4b6f275996e8e6efb4e10952192ac162d80c6da390a6c5e33eb9b007b4b
-
SSDEEP
24576:IYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9QyzHSy1x:IYREXSVMKi3ck
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0039000000015cc7-6.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259399460.bat" look2.exe -
Executes dropped EXE 2 IoCs
pid Process 2420 look2.exe 2664 svchcst.exe -
Loads dropped DLL 5 IoCs
pid Process 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 2420 look2.exe 2808 svchost.exe 2808 svchost.exe 2664 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\259399460.bat look2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2420 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 28 PID 3068 wrote to memory of 2420 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 28 PID 3068 wrote to memory of 2420 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 28 PID 3068 wrote to memory of 2420 3068 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 28 PID 2808 wrote to memory of 2664 2808 svchost.exe 31 PID 2808 wrote to memory of 2664 2808 svchost.exe 31 PID 2808 wrote to memory of 2664 2808 svchost.exe 31 PID 2808 wrote to memory of 2664 2808 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe"C:\Users\Admin\AppData\Local\Temp\25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2420
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:2488
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\259399460.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51fcea600b31caa6afe38f274dbc26fdd
SHA15f2306ae3943c7a73faef47660441d6ca071e13b
SHA25625ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114
SHA512e29506855d461eeb3db0687862386df8eb9d2a60bd3414f1cba955a802a139254cbac4b6f275996e8e6efb4e10952192ac162d80c6da390a6c5e33eb9b007b4b
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD53a84d363f3f98d25de2e51dc7ce8cf84
SHA1896cfc0b7c91d4a83ce713b516075f2199098f34
SHA256f5a93cca2b5bf40f2e9ac73703d1e05a680a7823359d4e7fc986da9972a251d2
SHA512f611a4d0338ae648ee99b1e340f431cc59571bc94bf7271e42c75159c7257329a7bf61cf21c0515044d697d1e4652d861e64e1c683b2e042716d11cb5bd181c4
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d