Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/01/2025, 06:18
General
-
Target
JaffaCakes118_47bc7aa23e046580e54a596f2301f73a.exe
-
Size
951KB
-
MD5
47bc7aa23e046580e54a596f2301f73a
-
SHA1
19f375d03b5a2d1fc8c05f18ebc2bb17304f54f0
-
SHA256
a35881e98b0df8d24eea1b78852ec6921ebcf0cf16bfeafd5da3453bdc4fc308
-
SHA512
46733f43604a26e0eed422b2fb6187e694edeb0311ccf4fc2ac939d80544a172bd3c69112553c234a0d02ce63ac906244e09db7777af0ad7d2031fd44c272509
-
SSDEEP
24576:hdufRX5CR3lXuOV2VfBEC1pGBWrvXABdswIo5Ao:hdUI3NNC1pHvwt
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bc7aa23e046580e54a596f2301f73a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bc7aa23e046580e54a596f2301f73a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\userinit.exeuserinit.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD5438a0ef8a82ada2a12b88a5ced2210a9
SHA1835ad257a40bd09008a4e4f3a7fb29ed72fa3ad9
SHA256dd72a35f8bde47093b96db75ada55f1ca91400ca0dabebdedcf82501c742ed24
SHA51209501ff5cb94518f2dc08746e302810326b8a734a7f6acdd315f80acf44dafe860c50a9d891d2fe4df4fa845848e633a3b9fdddecb065bfaeb98bcf5dc739f74
-
Filesize
951KB
MD505e3454f3a5527b8cbd500c1c46107a8
SHA183e2f6761de0ba62d27f1e766e5ada9b17bda8de
SHA256c7c54260a4f5f938053dcea746cdacea0a48504116369d7b0cedffa5a7f37a41
SHA512117031b33bc6c21728dcb74dcadedbf60d77c79087a94cb38c6ef5a23a9534650659d6930920006d4abb3acee23ccc2ef03ce71120d8de209d002dc5cf458d32
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB