Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 16:07
Behavioral task
behavioral1
Sample
a02b5c04cab961768dc8102aafead2d8ba39f5a29d0545819bf4ed39aed388a6.dll
Resource
win7-20240729-en
General
-
Target
a02b5c04cab961768dc8102aafead2d8ba39f5a29d0545819bf4ed39aed388a6.dll
-
Size
430KB
-
MD5
713b621e1a6c3867dfb152947ed8bf2c
-
SHA1
af68e5cce265a12945690875a542d204ea34201e
-
SHA256
a02b5c04cab961768dc8102aafead2d8ba39f5a29d0545819bf4ed39aed388a6
-
SHA512
e10c8714b9b21a015ffb75fc879653a9ad8426e37ddbf09a926634aca2750da623fc00d87a8a931e13b674e26cfce6129e0b265580d04dbbc506ef7e3d7f01a9
-
SSDEEP
12288:q9j8pWxJdNxnSJwu416c9y0wiL7s1T37AVu68VnogfN7oSR:q9I+dGwu13UVb+n3fNf
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4056-14-0x0000000000400000-0x0000000000543000-memory.dmp purplefox_rootkit behavioral2/memory/4056-16-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral2/memory/4056-13-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4056-14-0x0000000000400000-0x0000000000543000-memory.dmp family_gh0strat behavioral2/memory/4056-16-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral2/memory/4056-13-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Executes dropped EXE 1 IoCs
pid Process 3924 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 740 set thread context of 4056 740 rundll32.exe 84 -
resource yara_rule behavioral2/memory/740-0-0x0000000010000000-0x00000000100FE000-memory.dmp upx behavioral2/memory/4056-8-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-9-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-7-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-2-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-6-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-4-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-1-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-14-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral2/memory/4056-10-0x0000000000400000-0x0000000000543000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\NetMeeting\svchost.exe svchost.exe File opened for modification C:\Program Files (x86)\NetMeeting\svchost.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1068 cmd.exe 2136 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2136 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4056 svchost.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2872 wrote to memory of 740 2872 rundll32.exe 83 PID 2872 wrote to memory of 740 2872 rundll32.exe 83 PID 2872 wrote to memory of 740 2872 rundll32.exe 83 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 740 wrote to memory of 4056 740 rundll32.exe 84 PID 4056 wrote to memory of 1068 4056 svchost.exe 86 PID 4056 wrote to memory of 1068 4056 svchost.exe 86 PID 4056 wrote to memory of 1068 4056 svchost.exe 86 PID 1068 wrote to memory of 2136 1068 cmd.exe 88 PID 1068 wrote to memory of 2136 1068 cmd.exe 88 PID 1068 wrote to memory of 2136 1068 cmd.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a02b5c04cab961768dc8102aafead2d8ba39f5a29d0545819bf4ed39aed388a6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a02b5c04cab961768dc8102aafead2d8ba39f5a29d0545819bf4ed39aed388a6.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\svchost.exesvchost.exe fagahawhawhgawccc3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\SysWOW64\svchost.exe > nul4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2136
-
-
-
-
-
C:\Program Files (x86)\NetMeeting\svchost.exe"C:\Program Files (x86)\NetMeeting\svchost.exe" -auto1⤵
- Executes dropped EXE
PID:3924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5b7c999040d80e5bf87886d70d992c51e
SHA1a8ed9a51cc14ccf99b670e60ebbc110756504929
SHA2565c3257b277f160109071e7e716040e67657341d8c42aa68d9afafe1630fcc53e
SHA51271ba2fbd705e51b488afe3bb33a67212cf297e97e8b1b20ada33e16956f7ec8f89a79e04a4b256fd61a442fada690aff0c807c2bdcc9165a9c7be3de725de309