Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10037f80f7ee...46.exe
windows7-x64
3037f80f7ee...46.exe
windows10-2004-x64
1015e7399aea...b6.exe
windows7-x64
1015e7399aea...b6.exe
windows10-2004-x64
1018b4f16f04...7c.exe
windows7-x64
1018b4f16f04...7c.exe
windows10-2004-x64
1021d1163cd9...6e.exe
windows7-x64
1021d1163cd9...6e.exe
windows10-2004-x64
1026ef9e5b08...1a.exe
windows7-x64
1026ef9e5b08...1a.exe
windows10-2004-x64
1028cef7a303...ac.exe
windows7-x64
1028cef7a303...ac.exe
windows10-2004-x64
32f2d7c0a6...0d.exe
windows7-x64
1032f2d7c0a6...0d.exe
windows10-2004-x64
1033d03025fe...fb.exe
windows7-x64
1033d03025fe...fb.exe
windows10-2004-x64
1035da8e30ae...fd.exe
windows7-x64
1035da8e30ae...fd.exe
windows10-2004-x64
1038e9939621...14.exe
windows7-x64
1038e9939621...14.exe
windows10-2004-x64
1043fbcbf411...dd.exe
windows7-x64
1043fbcbf411...dd.exe
windows10-2004-x64
1047d09683fc...a3.exe
windows7-x64
1047d09683fc...a3.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 15:03
Behavioral task
behavioral1
Sample
037f80f7eee792aa95886508fc3cf946.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
037f80f7eee792aa95886508fc3cf946.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral3
Sample
15e7399aea87f41dcdc536b93452f3b6.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
15e7399aea87f41dcdc536b93452f3b6.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral5
Sample
18b4f16f04c2c21d6be60206341f337c.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
18b4f16f04c2c21d6be60206341f337c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
21d1163cd9edb6ae1478f2695e70836e.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
21d1163cd9edb6ae1478f2695e70836e.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
26ef9e5b08e4464b71e644ae57362b1a.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
26ef9e5b08e4464b71e644ae57362b1a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
28cef7a30348b7605c3e20208c2f79ac.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
28cef7a30348b7605c3e20208c2f79ac.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
32f2d7c0a6af9eb96bc8a9f18a95250d.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
32f2d7c0a6af9eb96bc8a9f18a95250d.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
33d03025fe17acc835808ac3b82b43fb.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
33d03025fe17acc835808ac3b82b43fb.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
35da8e30ae0228adb64b7d7d67b661fd.exe
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
35da8e30ae0228adb64b7d7d67b661fd.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
38e99396218a743516d6f98352c43314.exe
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
38e99396218a743516d6f98352c43314.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
43fbcbf4110bc9751de6c81fa49a57dd.exe
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
43fbcbf4110bc9751de6c81fa49a57dd.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
47d09683fc102a85a7dea2516ca81fa3.exe
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
47d09683fc102a85a7dea2516ca81fa3.exe
Resource
win10v2004-20231023-en
General
-
Target
28cef7a30348b7605c3e20208c2f79ac.exe
-
Size
228KB
-
MD5
28cef7a30348b7605c3e20208c2f79ac
-
SHA1
0eed34050f0e04757b46660365316d1ed1676fa4
-
SHA256
667657cd3f5cde93cfedd17ce283ce3bec2c6f296c9350de87e8e57eadf71831
-
SHA512
94f0aee84e6a80239840f9ae2337bf095f1ec074b4fc9a2093cc04c8df57ccab19eb437a26092c9251cec43d354c0e4e5458586a4f28360be55043710d4a19b3
-
SSDEEP
6144:j03mjlC3YAM2xfSu0Wz66L7D9gL1tBBcQdH69nhaOq:A3Z3YT2FSuPz66LW1BcQdaDab
Malware Config
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral11/memory/2780-0-0x00000000002E0000-0x000000000031E000-memory.dmp family_zgrat_v1 behavioral11/memory/2780-3-0x000000001BEA0000-0x000000001BF20000-memory.dmp family_zgrat_v1 behavioral11/memory/2780-4-0x0000000000920000-0x0000000000934000-memory.dmp family_zgrat_v1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2780 28cef7a30348b7605c3e20208c2f79ac.exe 2780 28cef7a30348b7605c3e20208c2f79ac.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2780 28cef7a30348b7605c3e20208c2f79ac.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2716 2780 28cef7a30348b7605c3e20208c2f79ac.exe 28 PID 2780 wrote to memory of 2716 2780 28cef7a30348b7605c3e20208c2f79ac.exe 28 PID 2780 wrote to memory of 2716 2780 28cef7a30348b7605c3e20208c2f79ac.exe 28 PID 2780 wrote to memory of 2716 2780 28cef7a30348b7605c3e20208c2f79ac.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe"C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"2⤵PID:2716
-