Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 06:09

General

  • Target

    38c2f198921ab41237a991512091135c_JaffaCakes118.exe

  • Size

    196KB

  • MD5

    38c2f198921ab41237a991512091135c

  • SHA1

    b1f33372f7211c68d9b7662b4c02ab29889049cd

  • SHA256

    c354fb2d435b4b571e31ccb955e9d92d0de97017ae94144f6de4338c81579ffe

  • SHA512

    dbee7fd35daab7354db346b4c6c53bdc1080444e2cfd5a4e79dc0a266d4f98c797bb1bea6158fc7a7024d94595dd4e9f5c791ef97df2d336134fe5a82772197e

  • SSDEEP

    6144:6sIt6nW8QjBTyPRFyhYPbHcTBlhHrFndnk00:39W8NJF8YPbHcT3H

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38c2f198921ab41237a991512091135c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\38c2f198921ab41237a991512091135c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2884
    • \??\c:\users\admin\appdata\local\hxsbumurno
      "C:\Users\Admin\AppData\Local\Temp\38c2f198921ab41237a991512091135c_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\38c2f198921ab41237a991512091135c_jaffacakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\hxsbumurno

    Filesize

    24.7MB

    MD5

    2a6e6a12a31185f3694dabc4c4754ee7

    SHA1

    c1bdf5acf64d7227220f311fe7a87fdbcaa19b82

    SHA256

    ce7710075546d01b57612537843074180e40c11c0491647eb1601206c2e90a65

    SHA512

    a39ce656e2403fad69cd641e1232e096208c52e2da13d98b407921df9630858c86d5f7d0e1b0914b278fe8e2204c2fde3082715e2e78f0a61fd3a7762ef6f0f7