Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
03/12/2023, 22:31
Behavioral task
behavioral1
Sample
60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe
Resource
win7-20231025-en
General
-
Target
60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe
-
Size
1.3MB
-
MD5
28995fd2b7e5c574cd5c910d2f1fa923
-
SHA1
38d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
-
SHA256
60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
-
SHA512
ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325
-
SSDEEP
24576:CIf0vEXsfmUSIPhLNdG0LwXtvhJmyNDnG:xfWtdPzdG0UU
Malware Config
Signatures
-
Detect PureLogs payload 7 IoCs
resource yara_rule behavioral1/memory/3068-0-0x0000000000B50000-0x0000000000C96000-memory.dmp family_purelogs behavioral1/files/0x003400000001463e-2225.dat family_purelogs behavioral1/files/0x003400000001463e-2227.dat family_purelogs behavioral1/files/0x003400000001463e-2228.dat family_purelogs behavioral1/memory/1656-2229-0x00000000003D0000-0x0000000000516000-memory.dmp family_purelogs behavioral1/files/0x003400000001463e-2232.dat family_purelogs behavioral1/files/0x003400000001463e-2242.dat family_purelogs -
Detect ZGRat V1 28 IoCs
resource yara_rule behavioral1/memory/2808-21-0x000000001AFC0000-0x000000001B0A4000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-22-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-27-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-25-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-23-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-29-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-31-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-35-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-33-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-37-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-39-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-45-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-43-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-53-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-55-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-57-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-51-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-49-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-47-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-41-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-59-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-63-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-61-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-65-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-69-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-67-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-71-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 behavioral1/memory/2808-73-0x000000001AFC0000-0x000000001B0A0000-memory.dmp family_zgrat_v1 -
Executes dropped EXE 2 IoCs
pid Process 1656 MajorRevision.exe 1368 MajorRevision.exe -
Loads dropped DLL 2 IoCs
pid Process 1644 taskeng.exe 1656 MajorRevision.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3068 set thread context of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 1656 set thread context of 1368 1656 MajorRevision.exe 34 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe Token: SeDebugPrivilege 2808 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe Token: SeDebugPrivilege 1656 MajorRevision.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 3068 wrote to memory of 2808 3068 60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe 29 PID 1644 wrote to memory of 1656 1644 taskeng.exe 33 PID 1644 wrote to memory of 1656 1644 taskeng.exe 33 PID 1644 wrote to memory of 1656 1644 taskeng.exe 33 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 PID 1656 wrote to memory of 1368 1656 MajorRevision.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe"C:\Users\Admin\AppData\Local\Temp\60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exeC:\Users\Admin\AppData\Local\Temp\60c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A4AEBE0D-F65B-400F-97F8-244AC432434E} S-1-5-21-1861898231-3446828954-4278112889-1000:PTZSFKIF\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\IsFamilyOrAssembly\tltwzpgtk\MajorRevision.exeC:\Users\Admin\AppData\Local\IsFamilyOrAssembly\tltwzpgtk\MajorRevision.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\IsFamilyOrAssembly\tltwzpgtk\MajorRevision.exeC:\Users\Admin\AppData\Local\IsFamilyOrAssembly\tltwzpgtk\MajorRevision.exe3⤵
- Executes dropped EXE
PID:1368
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD528995fd2b7e5c574cd5c910d2f1fa923
SHA138d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
SHA25660c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
SHA512ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325
-
Filesize
1.3MB
MD528995fd2b7e5c574cd5c910d2f1fa923
SHA138d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
SHA25660c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
SHA512ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325
-
Filesize
1.3MB
MD528995fd2b7e5c574cd5c910d2f1fa923
SHA138d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
SHA25660c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
SHA512ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325
-
Filesize
1.3MB
MD528995fd2b7e5c574cd5c910d2f1fa923
SHA138d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
SHA25660c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
SHA512ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325
-
Filesize
1.3MB
MD528995fd2b7e5c574cd5c910d2f1fa923
SHA138d8be92979b5a6cbb7a45df58cc1d41ce5f7a9a
SHA25660c0ab0cdcb4e608b2b400d19ad7e6b0705a85628bdf9b8ca42efe16cb07ccbc
SHA512ad33ea0538c85b21123a71bfb79fab22ba96e45d1f95da0d38b69eeee96d0fc91da620b5a30c771f66600593ccc57293a2073a4888930b9aa8de7bc735da7325