Overview

overview

10

Static

static

3

Ghosty Per...FN.exe

windows7-x64

10

Ghosty Per...FN.exe

windows10-2004-x64

10

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per...ry.dll

windows7-x64

5

Ghosty Per...ry.dll

windows10-2004-x64

5

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Ghosty Per...on.dll

windows7-x64

1

Ghosty Per...on.dll

windows10-2004-x64

1

Ghosty Per...ec.dll

windows7-x64

1

Ghosty Per...ec.dll

windows10-2004-x64

1

Ghosty Per...z2.dll

windows7-x64

1

Ghosty Per...z2.dll

windows10-2004-x64

1

Ghosty Per...pe.dll

windows7-x64

1

Ghosty Per...pe.dll

windows10-2004-x64

1

Ghosty Per...16.dll

windows7-x64

1

Ghosty Per...16.dll

windows10-2004-x64

1

Ghosty Per...rts.sh

windows7-x64

3

Ghosty Per...rts.sh

windows10-2004-x64

3

generate-certs.sh

windows7-x64

3

generate-certs.sh

windows10-2004-x64

3

1337/conve...rts.sh

windows7-x64

3

1337/conve...rts.sh

windows10-2004-x64

3

Ghosty Per...or.exe

windows7-x64

1

Ghosty Per...or.exe

windows10-2004-x64

1

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2024 09:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe

  • Size

    351KB

  • MD5

    877a111203c6c66509c6a946822050aa

  • SHA1

    bb88e7134729d0fa32335a573881f0bc73c298fe

  • SHA256

    b0080c00e9fbe13df87806bd20826eb9735a8b67f3f6aae58b3b370ed381003c

  • SHA512

    2723aaa1c12e7c64617da1a543c22f7a92a7df42cd825b78585711aaa650b330bfe75716fd5924e1b5b3d17ece2e6c9c2d69641ae1cc2b5e4889eff8cbef97a7

  • SSDEEP

    3072:v+iP3g1kBnFMYuOiFUlTRqg2VeHeKj6zJW9HTfYCf0ctQ46YLQhruyF0gXgv:v+tkFMYViFUlTRzye8NWpBYRwv

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\KA-MemIntegrity_x86_x64_v1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\KA-MemIntegrity_x86_x64_v1.1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads