Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 15:03 UTC

General

  • Target

    28cef7a30348b7605c3e20208c2f79ac.exe

  • Size

    228KB

  • MD5

    28cef7a30348b7605c3e20208c2f79ac

  • SHA1

    0eed34050f0e04757b46660365316d1ed1676fa4

  • SHA256

    667657cd3f5cde93cfedd17ce283ce3bec2c6f296c9350de87e8e57eadf71831

  • SHA512

    94f0aee84e6a80239840f9ae2337bf095f1ec074b4fc9a2093cc04c8df57ccab19eb437a26092c9251cec43d354c0e4e5458586a4f28360be55043710d4a19b3

  • SSDEEP

    6144:j03mjlC3YAM2xfSu0Wz66L7D9gL1tBBcQdH69nhaOq:A3Z3YT2FSuPz66LW1BcQdaDab

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe
    "C:\Users\Admin\AppData\Local\Temp\28cef7a30348b7605c3e20208c2f79ac.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
      2⤵
        PID:2716

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2780-0-0x00000000002E0000-0x000000000031E000-memory.dmp

      Filesize

      248KB

    • memory/2780-1-0x0000000000910000-0x0000000000916000-memory.dmp

      Filesize

      24KB

    • memory/2780-2-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

      Filesize

      9.9MB

    • memory/2780-3-0x000000001BEA0000-0x000000001BF20000-memory.dmp

      Filesize

      512KB

    • memory/2780-4-0x0000000000920000-0x0000000000934000-memory.dmp

      Filesize

      80KB

    • memory/2780-5-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

      Filesize

      9.9MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.