Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 12:15
General
-
Target
d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe
-
Size
96KB
-
MD5
d456e39eed7df3b00cb187af5a5416ce
-
SHA1
5be487bf1d610efc019eaaaec806a8e696730ca4
-
SHA256
1d62bb9231488ab53e7c5e46e7a537cfb23985278874364f9e9ae2ea4aa3f5f5
-
SHA512
b969b69bd0d8382789328addf40153a1d51d871439377a3de3afa7de2d05069ab2d28e5b26529afb904ccc3d85010f7defbba1a426b0ba57b03b89a0a990c1ce
-
SSDEEP
1536:0QFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prQK7DPOQnZHTj:0iS4jHS8q/3nTzePCwNUh4E9L7pZHTj
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\gmcnsygpqq"C:\Users\Admin\AppData\Local\Temp\d456e39eed7df3b00cb187af5a5416ce_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\d456e39eed7df3b00cb187af5a5416ce_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.1MB
MD5535967ef903e0cb76f9571cf5f7b40a1
SHA10fdd9e692f611fd559568273d7c328b7288e27fa
SHA25620cad84cbad024f5a5d0b7467623066c76cd171bce705722bb02e75554736159
SHA512d123fb892923490fa3d4e1369bef32165bf1a17e4ee72cf63cfb8ca38551e916fee7b88a095fc8e025dbab167431d503cb2c06ee40c1bd40b052e990507398f9
-
Filesize
23.4MB
MD5f8e38016f1a4215c851abf72481e0a1e
SHA1fc057dd1b0f1bcbbdebd216edda252ad8c308a4d
SHA25653aad6d834047919dc82b9bef0863c3fced619a3763917eed367373c75b736d8
SHA512aaab74304591068041c452fa0f53c83cff05a7aeb6bb6469a58c68680e54d5268c20aaf00dd301011e9dea7b2964d414403ce34935885596c274f6bd1bbfe066
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB