Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe
Resource
win10v2004-20241007-en
General
-
Target
b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe
-
Size
1.2MB
-
MD5
88d155d0b88571ced113631bde43becc
-
SHA1
40209615a825de70f53f3d1800771ff9319f460e
-
SHA256
b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
-
SHA512
62452ecb7f438a29501135322ae1430d29119c1e5a0d630c258d09f5586a39141ed67dbeadcdee6650efd796a548b9c461433026ae8011f27cc56701655c16dd
-
SSDEEP
24576:zYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9gyzd2jsS0:zYREXSVMKi3asS0
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023ccc-5.dat family_gh0strat -
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240633750.bat" look2.exe -
Executes dropped EXE 2 IoCs
pid Process 2332 look2.exe 4268 svchcst.exe -
Loads dropped DLL 3 IoCs
pid Process 2332 look2.exe 4700 svchost.exe 4268 svchcst.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\240633750.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language look2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2408 b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe 2408 b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2332 2408 b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe 82 PID 2408 wrote to memory of 2332 2408 b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe 82 PID 2408 wrote to memory of 2332 2408 b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe 82 PID 4700 wrote to memory of 4268 4700 svchost.exe 85 PID 4700 wrote to memory of 4268 4700 svchost.exe 85 PID 4700 wrote to memory of 4268 4700 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe"C:\Users\Admin\AppData\Local\Temp\b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵PID:3032
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\240633750.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD588d155d0b88571ced113631bde43becc
SHA140209615a825de70f53f3d1800771ff9319f460e
SHA256b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
SHA51262452ecb7f438a29501135322ae1430d29119c1e5a0d630c258d09f5586a39141ed67dbeadcdee6650efd796a548b9c461433026ae8011f27cc56701655c16dd
-
Filesize
337KB
MD5fb66e1e31fa1e6dfb21a50ccd11e0409
SHA16c45a0a115ec896eb14a531a44809b2a22cf8934
SHA2565ea8c5455f0ebe884ed98834e78ead8b6c68814bbb1723370299fa44b88c0faa
SHA51258ee149f70438296a67d5ae5cbd6cb9f5b2510a0381466b8f09eec3835be1ce7cad6903ca8fbc9273105132e85952208e78c59f776416c5449b86cc62111154b
-
Filesize
51KB
MD59104c24ce0576f3746bf304cdcda99fa
SHA1f04723070d0658f35da53b73da9e6cc3b43b028b
SHA25693295aa8e149c9cd3cd3f09fe85d80360b36d64afbb52b819e976525debb0126
SHA512458304fb2b257d8b54dee95e5edd4fdc094c1832ebe379d50db18ae6602fdbdd2d139de6485f98c519d2a35e2f5b7e97b4b1bd5573839baab837cc4fddd22b0f
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641