Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
11/03/2025, 14:35
General
-
Target
JaffaCakes118_65c8c246caa9b09a2b1e87f9d68af654.exe
-
Size
369KB
-
MD5
65c8c246caa9b09a2b1e87f9d68af654
-
SHA1
b4ad1936cb51aec53c943ff05f9ae6daf6445f7f
-
SHA256
5f3008ad95031759401227c1dac17f54a0ed38fce21270afc1d2287e8f1058e7
-
SHA512
b15f8429bf5bc9931f2d36209f1d82c5e502c419cdc55653f875fbde6c1878c6de3140ab99b0be6140774a00acd57ac2eb0995cca58b8587100492f51069d67e
-
SSDEEP
6144:pw0avOvtYSiod4uYzqAvZd/2469vmRcU4kRRourBQOWxdOLQzzDFNyBSVdLM:+vGvViG4HOKZde6RcoXfopM
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Drops file in System32 directory 6 IoCs
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65c8c246caa9b09a2b1e87f9d68af654.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65c8c246caa9b09a2b1e87f9d68af654.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\mrjyjghmhi"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_65c8c246caa9b09a2b1e87f9d68af654.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_65c8c246caa9b09a2b1e87f9d68af654.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 8042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1776 -ip 17761⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 9562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4080 -ip 40801⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 9322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2908 -ip 29081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
19.8MB
MD50b96b69c355d81a9e58a6ecb680218c7
SHA15e71b9880b668b3c6bd069bcdcbc529177001aad
SHA2565919adf2edcb1a63ed4b8b40490a2edac13fa6c11c79db9c225ec0226be44bf2
SHA5121d59d4ff0dc25fcfd0e0b49dedcd13465e21dac0b4b1cd56e8b4ba3fc3e6e1c4a332898697fcb8577a353702da1200cf2570e45c018f3b21b864af0579daa8e1
-
Filesize
203B
MD54211bc53e7f82938af6dd9ea3a9ca4f6
SHA14107181fd0b5a4eed3e11a0bb7b6671256af0e7d
SHA25687e2dc97265aa63fc35fe079b99fb34bb46c4d72ade787ed9e34812a645c3dfa
SHA5129011d3e9b0b3a1f11c76502608b75e456d9a35f8dea4bdcab64d9dd53dde5514ce196e7434f9e18ed43d47fafb74308e98399b580787de71b8b463e70f0def33
-
Filesize
305B
MD5a26ba5acea22d33d7d8a48c39619dfd0
SHA16909b719a9e461dd7e5563704fcb4de6f8d191b0
SHA2561903e884bec8608fd30ad7e56818b8822bd40c9b267cca0ec8a0fa1e3a5aa8ef
SHA51251b7ae04c93c181778635fdb306a2c3ee31745681909ff87e184cd559c370eaafa039b5c254ac93033e344d0711df912945038d92281092ea39f7a3c8b3e3ff3
-
Filesize
20.0MB
MD5d6c097fd649cb3768331b3ce903dacb3
SHA100ad67a19bc37bbad8e8e7fac7f9f327371c4cef
SHA2563dc94ff917e155b74af05603d86a1c97b0fc4cae0e60ed27e6d293c12f68cbca
SHA512f4c663849b5dc26c5173ea7d7cc03b19e77828e4610d030f9ff7e6f6cc844cc40fc42a25d0a35ff6fa67b541d9e8f30b4b0dc86af8448214a994e1f2e14e5133
-
Filesize
202KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
202KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
202KB
-
Filesize
202KB
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
156KB