Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.exe
-
Size
137KB
-
Sample
250127-td51xawrej
-
MD5
112cf157189c381867bd38ff908e2ceb
-
SHA1
b275452d72d1dc8da315085f406ecab8ac819dd8
-
SHA256
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b
-
SHA512
c95e5e6f7ec484d74c92682ef05f2d1fe9f990a5988736884596f28fc57941983dc50c1af99a020fa29006d2ddd82b98c70864d43676fc28a833c8269b9540b9
-
SSDEEP
3072:SR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuF:325GgFny61mraf
Static task
static1
Behavioral task
behavioral1
Sample
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.dll
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.exe
-
Size
137KB
-
MD5
112cf157189c381867bd38ff908e2ceb
-
SHA1
b275452d72d1dc8da315085f406ecab8ac819dd8
-
SHA256
a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b
-
SHA512
c95e5e6f7ec484d74c92682ef05f2d1fe9f990a5988736884596f28fc57941983dc50c1af99a020fa29006d2ddd82b98c70864d43676fc28a833c8269b9540b9
-
SSDEEP
3072:SR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuF:325GgFny61mraf
Score10/10-
Gh0st RAT payload
-
Gh0strat family
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1