Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.exe

  • Size

    137KB

  • Sample

    250127-td51xawrej

  • MD5

    112cf157189c381867bd38ff908e2ceb

  • SHA1

    b275452d72d1dc8da315085f406ecab8ac819dd8

  • SHA256

    a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b

  • SHA512

    c95e5e6f7ec484d74c92682ef05f2d1fe9f990a5988736884596f28fc57941983dc50c1af99a020fa29006d2ddd82b98c70864d43676fc28a833c8269b9540b9

  • SSDEEP

    3072:SR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuF:325GgFny61mraf

Malware Config

Targets

    • Target

      a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b.exe

    • Size

      137KB

    • MD5

      112cf157189c381867bd38ff908e2ceb

    • SHA1

      b275452d72d1dc8da315085f406ecab8ac819dd8

    • SHA256

      a22b75fa068f4c1267338be452e63ceeeb5c147a48782f0ba9f95d97ce85788b

    • SHA512

      c95e5e6f7ec484d74c92682ef05f2d1fe9f990a5988736884596f28fc57941983dc50c1af99a020fa29006d2ddd82b98c70864d43676fc28a833c8269b9540b9

    • SSDEEP

      3072:SR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuF:325GgFny61mraf

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks