Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
Resource
win10v2004-20240611-en
General
-
Target
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe
-
Size
1.6MB
-
MD5
1fcea600b31caa6afe38f274dbc26fdd
-
SHA1
5f2306ae3943c7a73faef47660441d6ca071e13b
-
SHA256
25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114
-
SHA512
e29506855d461eeb3db0687862386df8eb9d2a60bd3414f1cba955a802a139254cbac4b6f275996e8e6efb4e10952192ac162d80c6da390a6c5e33eb9b007b4b
-
SSDEEP
24576:IYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9QyzHSy1x:IYREXSVMKi3ck
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023436-5.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240599703.bat" look2.exe -
Executes dropped EXE 2 IoCs
pid Process 724 look2.exe 2836 svchcst.exe -
Loads dropped DLL 3 IoCs
pid Process 724 look2.exe 4128 svchost.exe 2836 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe File created C:\Windows\SysWOW64\240599703.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3152 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 3152 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3152 wrote to memory of 724 3152 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 83 PID 3152 wrote to memory of 724 3152 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 83 PID 3152 wrote to memory of 724 3152 25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe 83 PID 4128 wrote to memory of 2836 4128 svchost.exe 93 PID 4128 wrote to memory of 2836 4128 svchost.exe 93 PID 4128 wrote to memory of 2836 4128 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe"C:\Users\Admin\AppData\Local\Temp\25ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:724
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:4956
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240599703.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51fcea600b31caa6afe38f274dbc26fdd
SHA15f2306ae3943c7a73faef47660441d6ca071e13b
SHA25625ac52feb32cb6a749e08972d5b0a686f8a1e674496c9147cb23bb6c3d095114
SHA512e29506855d461eeb3db0687862386df8eb9d2a60bd3414f1cba955a802a139254cbac4b6f275996e8e6efb4e10952192ac162d80c6da390a6c5e33eb9b007b4b
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD53a84d363f3f98d25de2e51dc7ce8cf84
SHA1896cfc0b7c91d4a83ce713b516075f2199098f34
SHA256f5a93cca2b5bf40f2e9ac73703d1e05a680a7823359d4e7fc986da9972a251d2
SHA512f611a4d0338ae648ee99b1e340f431cc59571bc94bf7271e42c75159c7257329a7bf61cf21c0515044d697d1e4652d861e64e1c683b2e042716d11cb5bd181c4
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641