Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2024, 08:02 UTC

General

  • Target

    f207eecea8f248434744966cf6221ce8669a62945fc6da69eed9d8885bc9cd37.dll

  • Size

    437KB

  • MD5

    0ed2acffb97260cb0e595d38e9946507

  • SHA1

    8920348471b618274bf6f4fb43b4ef17787076f8

  • SHA256

    f207eecea8f248434744966cf6221ce8669a62945fc6da69eed9d8885bc9cd37

  • SHA512

    b90d908bf5d43a4d15d89666e7ffcc5363a49be40f0e3513fbaa80325fe0fcd744ae23767199fd72a8f1e046c59d84c23590cb29e0928250f83695ddc9746362

  • SSDEEP

    6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6W0:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoSu

Malware Config

Signatures

  • Detect PurpleFox Rootkit 2 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
        2⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2396
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
        2⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f207eecea8f248434744966cf6221ce8669a62945fc6da69eed9d8885bc9cd37.dll,#1
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\f207eecea8f248434744966cf6221ce8669a62945fc6da69eed9d8885bc9cd37.dll,#1
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2916

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      www.qkjyaym.cn
      LocalServiceNetworkRestricted
      Remote address:
      8.8.8.8:53
      Request
      www.qkjyaym.cn
      IN A
      Response
    • flag-us
      DNS
      25.140.123.92.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      25.140.123.92.in-addr.arpa
      IN PTR
      Response
      25.140.123.92.in-addr.arpa
      IN PTR
      a92-123-140-25deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      138.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      138.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      37.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      37.56.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.143.123.92.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.143.123.92.in-addr.arpa
      IN PTR
      Response
      240.143.123.92.in-addr.arpa
      IN PTR
      a92-123-143-240deploystaticakamaitechnologiescom
    • flag-us
      DNS
      www.qkjyaym.cn
      LocalServiceNetworkRestricted
      Remote address:
      8.8.8.8:53
      Request
      www.qkjyaym.cn
      IN A
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 10.127.0.180:8088
      LocalServiceNetworkRestricted
    • 10.127.0.180:8088
      LocalServiceNetworkRestricted
    • 10.127.0.180:8088
      LocalServiceNetworkRestricted
    • 10.127.0.180:8088
      LocalServiceNetworkRestricted
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      www.qkjyaym.cn
      dns
      LocalServiceNetworkRestricted
      60 B
      124 B
      1
      1

      DNS Request

      www.qkjyaym.cn

    • 8.8.8.8:53
      25.140.123.92.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      25.140.123.92.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      138.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      138.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      37.56.20.217.in-addr.arpa
      dns
      71 B
      131 B
      1
      1

      DNS Request

      37.56.20.217.in-addr.arpa

    • 8.8.8.8:53
      240.143.123.92.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      240.143.123.92.in-addr.arpa

    • 8.8.8.8:53
      www.qkjyaym.cn
      dns
      LocalServiceNetworkRestricted
      60 B
      124 B
      1
      1

      DNS Request

      www.qkjyaym.cn

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2396-3-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-1-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-9-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-11-0x0000000077B93000-0x0000000077B94000-memory.dmp

      Filesize

      4KB

    • memory/2396-8-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-7-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-2-0x0000000000400000-0x0000000000543000-memory.dmp

      Filesize

      1.3MB

    • memory/2396-22-0x0000000010000000-0x00000000101A0000-memory.dmp

      Filesize

      1.6MB

    • memory/2396-24-0x0000000010000000-0x00000000101A0000-memory.dmp

      Filesize

      1.6MB

    • memory/2744-21-0x0000000077B70000-0x0000000077C60000-memory.dmp

      Filesize

      960KB

    • memory/2744-54-0x0000000077B70000-0x0000000077C60000-memory.dmp

      Filesize

      960KB

    • memory/2916-0-0x0000000010000000-0x00000000100A6000-memory.dmp

      Filesize

      664KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.