Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
01/03/2025, 09:17
General
-
Target
JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe
-
Size
187KB
-
MD5
381d447e684ea367a361497d6a1904a6
-
SHA1
02a1c361ccee424b81cfdc5530d7ac3704976118
-
SHA256
3593d91963825f37255fac53653ae06db577cbfa83019a1d047ba2ef9c1676ca
-
SHA512
b78bb4f220bb6b3b5f64564206072d965542e92784d8effd84852d60fabcf7c0b5218ec3d1e6ad68f5d4da550c829b5e945705cfe0dc80a360a80a945ff5b645
-
SSDEEP
3072:iRZOScqPd0Gh0QMXbPhYiWxwDdR2cxXePtdIbZx7rR1UWrfS36OhpddQJ34:iG2e7rPhYicIyc9WtGZx7lCWODPk3
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_381d447e684ea367a361497d6a1904a6.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5f2aebd580856cad52f071b72e8a4b4d9
SHA16771759a9b71e5ed27abfe23cfc66e17f4c853b3
SHA2564351d370088a1bfe81a27b5270dc8bf212ea5c77a636c51e09417ac1aac0fe73
SHA5129a2d5c4244e889ad17d783bfa2a512d0b8bf9e6c57dc3679d413344440d8f97721e75b8f62b215040b80289742275acefbac271ae8d777c879b7cad891cdda5c
-
Filesize
98B
MD5af965fb36c703ebc5667b61ee7d57ab2
SHA11070c851b29d19d24f12d5a5f433c32210b394f5
SHA2566c8a95bad312f3d167b872a834842f179f52d6fe2ee165eda9e1d837b71501b9
SHA51273398a7cbb94b0243dc9b96fa366e5a121b922e1fe299d444da6d97b127a1d9534deb4fa0d3c7ff823ad381ce650482892ff056fb220a5988760a89b3d45f4f3
-
Filesize
2.8MB
MD5011e022d92f4005137ba740485e99c26
SHA17797761a2c97510581b73e0b997982f973eeb5be
SHA256215de4b4cf87964b28490d16c065102f5f76fffff54f8fc6c9b5647ff40bd51b
SHA5125c7a5f2062df6e8a32fb15e0646c5d86ba39eab41a2af7c7a60957dd877d3a08c426e8e70e52a1104f31d59e1cef9a0b4cc606eaf2039b6d1195601a186ea5b5
