Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
26/11/2023, 05:38
General
-
Target
b843b704dd6690f5cc7a8a400674b054.exe
-
Size
3.9MB
-
MD5
b843b704dd6690f5cc7a8a400674b054
-
SHA1
fec8571d6b9e1ae91e4cb0ff7d1a6477ff0888a9
-
SHA256
fc07e1f14fe415abbf50144169406b444d1a70a06332892004d29e286da08f37
-
SHA512
29f7e4bb063677f848ba45eb0e90dba542dceff1aa7c8a517d42645700545058fb6e507bc267678c0cc8c73d6f070f21e7d5bc78bd2540b5bd0384c0d4d3c2a3
-
SSDEEP
98304:ySA5A5qQ2o3QCHp2IzQCI2qQv3zjb7iK3OPBOMVw/WBmCL:Vv5WUQC4IzQL21zjb7X3uQMVYzO
Malware Config
Signatures
-
Detect ZGRat V1 6 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b843b704dd6690f5cc7a8a400674b054.exe"C:\Users\Admin\AppData\Local\Temp\b843b704dd6690f5cc7a8a400674b054.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\bridgeintoPerfdll\FUtKAenxZ.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\bridgeintoPerfdll\SVKIEXo2DS.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\bridgeintoPerfdll\Msnetcommon.exe"C:\bridgeintoPerfdll/Msnetcommon.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9nDtWiztzP.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
-
C:\Program Files (x86)\Windows Sidebar\Gadgets\wininit.exe"C:\Program Files (x86)\Windows Sidebar\Gadgets\wininit.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5d6ded16404f42a6c35348feb7a6c326a
SHA1ca8bef9f09db5ba365826b95fedc9bbe2b973216
SHA256aedfdd5242db717a51fbb4e58b5dd17bb8a1ec5c19243724b9dd96d390de3842
SHA512d91ca671402afa493c6d74b7ff810570ccf849c5087851e3d19c880eff646565e7045b21e90a5a6189ed101a63af9eb028f404c9a0348f928e63246764f78746
-
Filesize
3.6MB
MD5d6ded16404f42a6c35348feb7a6c326a
SHA1ca8bef9f09db5ba365826b95fedc9bbe2b973216
SHA256aedfdd5242db717a51fbb4e58b5dd17bb8a1ec5c19243724b9dd96d390de3842
SHA512d91ca671402afa493c6d74b7ff810570ccf849c5087851e3d19c880eff646565e7045b21e90a5a6189ed101a63af9eb028f404c9a0348f928e63246764f78746
-
Filesize
186B
MD5a1fc296af10600972fbc5869e9d49e56
SHA192485c2ea832365b7760e4892feddf4b7869407f
SHA2565a3837ae6cc7a30a25119fe53e481393892f4b27b3c49812fbba3a344de0c5cc
SHA512df3dfdbf33d3f323416f07f2d83f97585f2d7ff8491f5bc4a45569c9b7ca8323251b883166a29922a5d34a810ff193b3c723c7c92223a76e3dfab8071d4afe96
-
Filesize
3.6MB
MD5d6ded16404f42a6c35348feb7a6c326a
SHA1ca8bef9f09db5ba365826b95fedc9bbe2b973216
SHA256aedfdd5242db717a51fbb4e58b5dd17bb8a1ec5c19243724b9dd96d390de3842
SHA512d91ca671402afa493c6d74b7ff810570ccf849c5087851e3d19c880eff646565e7045b21e90a5a6189ed101a63af9eb028f404c9a0348f928e63246764f78746
-
Filesize
205B
MD5ca9c208817e4eff516342d7dbd58cf27
SHA18ce27a728720ffb14f972cfe52a58c678890edc3
SHA25618d95a16d9f533dc521aa30a7e714bcbe5cb976883b951e7a7d7ebfcb1565857
SHA512ce8201ba3db66bccfa446df92ae82afb15a1f3817648b260bec5462e86ed2bd94ab4540ccfe3b127a3ade0ea21a0f6af6c817e3632ec363cee25d66e47fa04f4
-
Filesize
3.6MB
MD5d6ded16404f42a6c35348feb7a6c326a
SHA1ca8bef9f09db5ba365826b95fedc9bbe2b973216
SHA256aedfdd5242db717a51fbb4e58b5dd17bb8a1ec5c19243724b9dd96d390de3842
SHA512d91ca671402afa493c6d74b7ff810570ccf849c5087851e3d19c880eff646565e7045b21e90a5a6189ed101a63af9eb028f404c9a0348f928e63246764f78746
-
Filesize
3.6MB
MD5d6ded16404f42a6c35348feb7a6c326a
SHA1ca8bef9f09db5ba365826b95fedc9bbe2b973216
SHA256aedfdd5242db717a51fbb4e58b5dd17bb8a1ec5c19243724b9dd96d390de3842
SHA512d91ca671402afa493c6d74b7ff810570ccf849c5087851e3d19c880eff646565e7045b21e90a5a6189ed101a63af9eb028f404c9a0348f928e63246764f78746
-
Filesize
87B
MD5b4c177d380fff1fe04e01223a66e0878
SHA12c9fef271f9c1633af8b8467f1e3956572d5f387
SHA25656709fc7efc983e335352d009ae39344005df1c5bd49a3bfcc2d1f5c9ad08128
SHA5129f8efe43cc18694cbbf002f011316c21afaea7f17923bc1dd21cd84fe8ea89667159eb5a5738ad667f549341b11fce845fc2bdaa93b690e79d3087e082d824f0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
760KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
3.6MB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
5.2MB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB