Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/03/2025, 09:17
General
-
Target
JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe
-
Size
187KB
-
MD5
381d447e684ea367a361497d6a1904a6
-
SHA1
02a1c361ccee424b81cfdc5530d7ac3704976118
-
SHA256
3593d91963825f37255fac53653ae06db577cbfa83019a1d047ba2ef9c1676ca
-
SHA512
b78bb4f220bb6b3b5f64564206072d965542e92784d8effd84852d60fabcf7c0b5218ec3d1e6ad68f5d4da550c829b5e945705cfe0dc80a360a80a945ff5b645
-
SSDEEP
3072:iRZOScqPd0Gh0QMXbPhYiWxwDdR2cxXePtdIbZx7rR1UWrfS36OhpddQJ34:iG2e7rPhYicIyc9WtGZx7lCWODPk3
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5f2aebd580856cad52f071b72e8a4b4d9
SHA16771759a9b71e5ed27abfe23cfc66e17f4c853b3
SHA2564351d370088a1bfe81a27b5270dc8bf212ea5c77a636c51e09417ac1aac0fe73
SHA5129a2d5c4244e889ad17d783bfa2a512d0b8bf9e6c57dc3679d413344440d8f97721e75b8f62b215040b80289742275acefbac271ae8d777c879b7cad891cdda5c
-
Filesize
316KB
MD51741c490e9c4e3dcc5dea771ff4dbde0
SHA1f6d52536f90d7b9d1dfb399c873d36a46a185821
SHA25603794bea2f7ff12bbf63a7f098aa8872eb9f23eac512ece298acbf5275e3c000
SHA51222966532da8815d08b459ff16c86781723b3cc39b6f938073f453e979ff7374ba161e6b862fc504c150a546557a3a8a0ce8a009b9bda5ea450fe085b2d38e8fe
-
Filesize
99B
MD533475c21acdb597ca80d2575041d2caf
SHA1ba01786db3fb1791caef10528569e2314862d46e
SHA2565653033fa1e000c9c8dc0d8feafc20063f41678afcc6e91a2bb29e93f0051cef
SHA5128df11b59329473e68081cced898da9efaf67d550f1b000e2095bf2e17bee41e81f972fbe36bd23abfee8de1148698b534b231ddb167164e174088ae100e279eb
-
Filesize
9.0MB
MD5a09c781839276df16b5a942dbc99c2a9
SHA1e99ed645eb963532ebb5f913b851fef1f280c868
SHA256a63b0dc83dfb65fcaa059528620d4c00c849eae2ff700d1aac51fd34d2c2136d
SHA512a98402e8fa314089f1c15f1919eb9d5fc479d508de63e25d9338b715a5f42aabdb6506ffa62f8931314419aad41477f4c5597e6df5836410e3581fece15d32b4
-
Filesize
124KB
