Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
01/11/2023, 15:03
General
-
Target
28cef7a30348b7605c3e20208c2f79ac.exe
-
Size
228KB
-
MD5
28cef7a30348b7605c3e20208c2f79ac
-
SHA1
0eed34050f0e04757b46660365316d1ed1676fa4
-
SHA256
667657cd3f5cde93cfedd17ce283ce3bec2c6f296c9350de87e8e57eadf71831
-
SHA512
94f0aee84e6a80239840f9ae2337bf095f1ec074b4fc9a2093cc04c8df57ccab19eb437a26092c9251cec43d354c0e4e5458586a4f28360be55043710d4a19b3
-
SSDEEP
6144:j03mjlC3YAM2xfSu0Wz66L7D9gL1tBBcQdH69nhaOq:A3Z3YT2FSuPz66LW1BcQdaDab
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 3 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe"C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
80KB
-
Filesize
9.9MB