Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2025, 21:53
Behavioral task
behavioral1
Sample
0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe
Resource
win7-20240708-en
General
-
Target
0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe
-
Size
1.2MB
-
MD5
f1b31376206ae25b5ee1c854698f7c1c
-
SHA1
64cae66ccf1278da3cc1bbd4cc097ad9a1c290a0
-
SHA256
0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022
-
SHA512
53a36b7cfa3d575164ad302cb5ad99273828e57ae676265b3acac5b000b71048444e640151e41a76104b2b0e829f6dabd3ba694435110c36d2626e72e8e92871
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiA:WIwgMEuy+inDfp3/XoCw57XYBwKA
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1556-26-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/1556-25-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/2080-33-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/2080-34-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/748-40-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/748-48-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/748-49-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral2/files/0x0007000000023c9e-17.dat family_gh0strat behavioral2/memory/1556-26-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/1556-25-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/2080-33-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/2080-34-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/748-40-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/748-48-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/748-49-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Ghiya.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Ghiya.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Executes dropped EXE 5 IoCs
pid Process 4408 AK47.exe 2168 AK47.exe 1556 AK74.exe 2080 Ghiya.exe 748 Ghiya.exe -
Loads dropped DLL 1 IoCs
pid Process 2168 AK47.exe -
resource yara_rule behavioral2/memory/3280-0-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-1-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/files/0x0008000000023caa-56.dat vmprotect behavioral2/memory/3280-62-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-65-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-68-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-72-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-75-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-78-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/3280-82-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe" 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\240625984.txt AK47.exe File created C:\Windows\SysWOW64\240625984.txt AK47.exe File created C:\Windows\SysWOW64\Ghiya.exe AK74.exe File opened for modification C:\Windows\SysWOW64\Ghiya.exe AK74.exe -
resource yara_rule behavioral2/memory/1556-23-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/1556-26-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/1556-25-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2080-31-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2080-33-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2080-34-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/748-40-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/748-48-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/748-49-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 116 2168 WerFault.exe 84 220 4408 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4224 cmd.exe 444 PING.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 444 PING.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 748 Ghiya.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1556 AK74.exe Token: SeLoadDriverPrivilege 748 Ghiya.exe Token: 33 748 Ghiya.exe Token: SeIncBasePriorityPrivilege 748 Ghiya.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3280 wrote to memory of 4408 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 83 PID 3280 wrote to memory of 4408 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 83 PID 3280 wrote to memory of 4408 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 83 PID 3280 wrote to memory of 2168 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 84 PID 3280 wrote to memory of 2168 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 84 PID 3280 wrote to memory of 2168 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 84 PID 3280 wrote to memory of 1556 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 90 PID 3280 wrote to memory of 1556 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 90 PID 3280 wrote to memory of 1556 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 90 PID 1556 wrote to memory of 4224 1556 AK74.exe 92 PID 1556 wrote to memory of 4224 1556 AK74.exe 92 PID 1556 wrote to memory of 4224 1556 AK74.exe 92 PID 2080 wrote to memory of 748 2080 Ghiya.exe 93 PID 2080 wrote to memory of 748 2080 Ghiya.exe 93 PID 2080 wrote to memory of 748 2080 Ghiya.exe 93 PID 3280 wrote to memory of 4236 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 96 PID 3280 wrote to memory of 4236 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 96 PID 3280 wrote to memory of 4236 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 96 PID 3280 wrote to memory of 3496 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 97 PID 3280 wrote to memory of 3496 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 97 PID 3280 wrote to memory of 3496 3280 0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe 97 PID 4224 wrote to memory of 444 4224 cmd.exe 95 PID 4224 wrote to memory of 444 4224 cmd.exe 95 PID 4224 wrote to memory of 444 4224 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe"C:\Users\Admin\AppData\Local\Temp\0c24ecf71eeb7fa6303dd119c3ada91a422b487da4ef3aa97e6f1ec38085c022.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 3923⤵
- Program crash
PID:220
-
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 4203⤵
- Program crash
PID:116
-
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:444
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:4236
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2168 -ip 21681⤵PID:2512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4408 -ip 44081⤵PID:2352
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:748
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
92B
MD529ce53e2a4a446614ccc8d64d346bde4
SHA139a7aa5cc1124842aa0c25abb16ea94452125cbe
SHA25656225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df
SHA512b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa
-
Filesize
753B
MD5720055d219eb3da10c1652a9d84c4a3f
SHA12e18332c65d1eff60355a7e2e78e1b5e17d4c1d5
SHA256b0a540230edda81eeb897cd462f9978cab508d11a193395832bff9e510ac2c68
SHA5126caa18caeaa6d8497937d38ddc8392c210f49ea10ed4e85acce005729342349d90cc4a87f87fea3728f728a31ce98f5d2859d76e4b48e76f4cda750e7637f19d
-
Filesize
1.2MB
MD5feb56d35590a0f54a500b5eacfb09c11
SHA17f7974760a547fce0c5b329e5c896e8bd2fa6150
SHA25605d3bab31dd9134d05ba99b8e1d8d749cb3bb712609cd678c6c38892312d11a2
SHA51206a33009b29fb7c0a6805487f38c5bc7532d3f09801da7ee25559b559c7235937985c4b370afaec3456e3113ac225e7458701056d4ca46c6b7749e3d33760809
-
Filesize
49KB
MD5de0b3d4ee00b1751390a788039926690
SHA191b4ea3e50ea261835292a8e1da3817b1035598c
SHA2568a4fe38a9c4dc844f0b438cbc203c9e5eb1c9496c6f4f48f65bcab2d646f46da
SHA5128669d4df267df5ddbc895359fc9244235539784fa6971083ef32315caebec4e37e7a1900074d5220dcfe2ce49a3e1f86d10c4b18f458668df64974e8ad14395f