Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
11/03/2025, 10:51
General
-
Target
JaffaCakes118_64d2fe249a6351c6cba6ec992c88a949.exe
-
Size
199KB
-
MD5
64d2fe249a6351c6cba6ec992c88a949
-
SHA1
efec281cda06f13752529259ad86ef3aef4dd886
-
SHA256
3d310f1c83539cfd32240d5f1f6304b9a3babdfe3bb6c78c402608e6369a5e11
-
SHA512
3a4be3705b93a03efa4278f05cd2db14a6011bf24c939d0fa59d7f6da9b73ffd9c554b69945d3472b282b38e5bfaf55e453e60f477ac413cd2108cb7416e42e6
-
SSDEEP
3072:X/cL0SvOVVsWT18scaU1ODuI8Jb8oBXv/4jO5pIs1Sm8:X/O0SvO4WKscaU1OCtJ4un4jOpYm8
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64d2fe249a6351c6cba6ec992c88a949.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64d2fe249a6351c6cba6ec992c88a949.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\hptchqhmbj"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64d2fe249a6351c6cba6ec992c88a949.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_64d2fe249a6351c6cba6ec992c88a949.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s fastuserswitchingcompatibility1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s ias1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s irmon1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s nla1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s ntmssvc1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s nwcworkstation1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s srservice1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s wmi1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s wmdmpmsp1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s logonhours1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s pcaudit1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s helpsvc1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ???s????h -s uploadmgr1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ??1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.8MB
MD57de8ecb34bfd68ea7d24db01907bdba3
SHA198d6536904f62cba6db741b00cd722e84b06a303
SHA256c9333eddb968dc34a3761dd32dc67850b428017ed1538d8febe0ff652e26cb16
SHA5128e9cb2baa6f5b7a0424855d42c538440e25b78a717336e51c4720748c22d0308a64ad5380bbb1194ba23c0c36df22b0bcfb8b64dd1eaa2ca116f2da7acaf089a
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB