Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2025, 08:58

General

  • Target

    JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe

  • Size

    176KB

  • MD5

    4916ebcb1d4fc22bb0a9d8f0114b5edc

  • SHA1

    916cde50f58a8b94be7c29ae16965f5b194657c6

  • SHA256

    20c016f775260c8348004416a0757c716d76ce80328e98614fa52e699e232bc1

  • SHA512

    4b70d59ce3ba4f056059afbb365ea655cd7ed5616ca665cfd7fbdfbaf354c8aca384cbb20a8cad3600cf2ea64810c464ffe36132988bb37003e4a81cb1baa158

  • SSDEEP

    3072:RcYcYKEzcW526y6hs6PhwtqrorsVlkTEIcy1O4F3JhMWIknqX5d+vIjc8UW:RcBYKEz557e2VroYoTU4JOWnS5d+v0cu

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • Blocklisted process makes network request 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2612
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan
      2⤵
      • Blocklisted process makes network request
      • Deletes itself
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\hfsetemp.ini

    Filesize

    365B

    MD5

    0c6fb48ec14cf0535df55de346aad98a

    SHA1

    3ded5fa6488a3fbc0ae8ffa8269732d17cbfb82c

    SHA256

    b59f28f8e20f0eb15cae824246fd105d3e5a912fb94355e096efdce3165c29f8

    SHA512

    2fbad828180479c22a9f9496f322c4763c225724081c956cad9b9ba0da71121db664071093a1074ed9c18db926717c0cafcfe6e82e4eb9009bdb271238464909

  • \??\c:\windows\SysWOW64\winnie.cmd

    Filesize

    1.1MB

    MD5

    67d1b4b96ce31e39c35cc856a0b48e80

    SHA1

    93bd97523fe9ddde52187bb52bcb31d35bf9d4c5

    SHA256

    c74fd5340fb0f9c3fecf7817c56e2fe7699fc3d5814ced2ce869f65edd24c975

    SHA512

    eaa25222bd9c6d5718758e5b55476fb4a9fe9e9ba120c4607e7cb71ea63fde26a8b8b2560c548ab82cc4a233e0d1ec5f1266ae19fada9360f358425d263cb0f1