Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
01/03/2025, 04:56
General
-
Target
JaffaCakes118_36dd0b35f717a6c103d37fb43fca54c0.exe
-
Size
369KB
-
MD5
36dd0b35f717a6c103d37fb43fca54c0
-
SHA1
45a09caacd3cdea944840d493d9457e84d44ab4d
-
SHA256
3dbfe53c49d06de30219517e2e17a552f579eb70065e75f978674f1aa372bb92
-
SHA512
cc7ed329e6dbe6265811611c47c08afbaf030e9e3660bb6682186dcd4f4173dafa67f8c64bc644f6670af52e6ccc35339cff93af0eb4c6f755a275dfe4fda2f4
-
SSDEEP
6144:esIs6nW8gXBTyPRqyhYPbHcTBlhHrQndnkv0wnudcmfSIAHm9YN5sP3ZxDnLvMwb:TKW8pJq8YPbHcT3bdn6ccK+zThCw
Malware Config
Signatures
-
Gh0st RAT payload 10 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops file in System32 directory 6 IoCs
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36dd0b35f717a6c103d37fb43fca54c0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36dd0b35f717a6c103d37fb43fca54c0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\giwytxmuiw"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36dd0b35f717a6c103d37fb43fca54c0.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_36dd0b35f717a6c103d37fb43fca54c0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 10802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3656 -ip 36561⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 11042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1184 -ip 11841⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 11082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4584 -ip 45841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
24.8MB
MD530a119ed029f2796159cb14f043c15d8
SHA1bfaf0555ad9c3a09e81e36f46fadafd38ea1be80
SHA2563f33a64ab58fe9992370ca4b4fed285ec499e55fe152a5026a7272f6f7792f50
SHA5127754d30c73d0be68f467462b0c89d83244e5356b240b7cc7e01c058e8aa9eebc1694ab6fbb07571f30f2777a30691c1c8d54469c7aca2c94ab864027de594e61
-
Filesize
198B
MD5f6668714112ba2683daa583516cdd6bb
SHA10a0c862cc67a33755c3241263a042db19bf09f43
SHA256ed46a14e6db18314b8720240f00810db4b60d7eb26736d7620b23024efa58c1d
SHA5125c2c4245686e1de64f45941777fead84bb0965b86fbffc1b78aee6a0e2839af885ff8193863764b6ee670e6b3fa600aa0de53ea32f10c406cd6812126d639d1b
-
Filesize
297B
MD5bfd3f5d8d0bc44c4203f189aa00ef482
SHA1bd42fcc09ad9a405a3d35a654ab2008859036ed2
SHA256938ba90eab6ce76c2c25a1d2b790c7092ba5e7d1b8c0f128b40db5c05b5c352d
SHA512ff61df99ca6abb3ab6907200cfcfdfed9e01402fba9e1acacfe919c8d21015412f522a52a1dc6dfa475ecebd1a875b8053f936ef7b47abc5a1f3499f3acba690
-
Filesize
21.0MB
MD51801a6f16149de255712c306ceafabaa
SHA113b74806bb3e9a58ce90a302e7459bd7b8d1b8a5
SHA25611c8176e5daf2963515ff6e42983a0f1a889762e45dfaadfd3f5649ca1977c83
SHA5127be9767d4b8210e91c68d5bd53e32fc1bea63525d78cb86b7705553c3db0a05619dcd65c9e90d4f1be5a1024c78c08c1d37b86ab02657ab031ba78f59fab2396
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
202KB
-
Filesize
4KB
-
Filesize
202KB
-
Filesize
460KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
202KB
-
Filesize
460KB
-
Filesize
202KB
-
Filesize
460KB
-
Filesize
202KB