Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
11/03/2025, 12:39
General
-
Target
JaffaCakes118_654a48d3ae219afa42505255da375ddf.exe
-
Size
321KB
-
MD5
654a48d3ae219afa42505255da375ddf
-
SHA1
27ff246dcf2dee78360a295d9e9839fa1e8bd7be
-
SHA256
485346b9f03c73c06c3fd3bf211955ade464a6d5ad92bd7002b40e6b0da3c32d
-
SHA512
1d072cc3ff97822d77d3a34d0c387f7d1d7c6196f8162cd1895b667a1d1a48b9260fda7960bcd5fee2fa4ab90f2c69dd403f863491998c5f7d4b70410ccb3727
-
SSDEEP
6144:76cPpODxCdS7eOUQ41xrbqJSyB1/P676Go6FGwbqydWLWYTvCV+CP7zLEtv+jv:7VcC8SIn6764FNdoTvCVL7zKav
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_654a48d3ae219afa42505255da375ddf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_654a48d3ae219afa42505255da375ddf.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD53269e8362685c8ef4b5cd2a1d298e177
SHA18f39d8496ee3fee4319bcab60b2ab6d5da51ea6f
SHA256e11ef33d6ade49e842b604309529b5a6123525d79b93b9545bffbfe0e5fbaaf2
SHA5129c616d9be687ae4a9ff17e7436bbdbd71bd84b0ec7dc3daa4a36cd8d5b3d9da7d9d3694b79f9be770a5daf020bd42957eb6051ee83cb2bb27b0022a78663f133
-
Filesize
460KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
96KB