Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2023, 04:15

General

  • Target

    64944a1f7d846006e04b6101d40a28b4.exe

  • Size

    1.2MB

  • MD5

    64944a1f7d846006e04b6101d40a28b4

  • SHA1

    139989bce70344cee6a009cbe197e43c263aa6a5

  • SHA256

    311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

  • SHA512

    da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

  • SSDEEP

    24576:yV4G6JWrIWNuFYRF4Bs2kpvjpqzeRVXJIcXStT:y4WrIWMietCvjtRVJCJ

Malware Config

Signatures

  • Detect PureLogs payload 7 IoCs
  • Detect ZGRat V1 29 IoCs
  • PureLogs

    PureLogs is an infostealer written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
    "C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
      C:\Users\Admin\AppData\Local\Temp\64944a1f7d846006e04b6101d40a28b4.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {4AA96890-1EE8-4D65-B55A-8365DCAC9357} S-1-5-21-2084844033-2744876406-2053742436-1000:GGPVHMXR\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe
      C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe
        C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
          4⤵
            PID:1816
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
            4⤵
              PID:1508
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              4⤵
                PID:1660
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                4⤵
                  PID:556
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                  4⤵
                    PID:1532
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                    4⤵
                      PID:3068
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                      4⤵
                        PID:3024
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                        4⤵
                          PID:1512
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                          4⤵
                            PID:2500
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                            4⤵
                              PID:1128

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • C:\Users\Admin\AppData\Local\Exception\dqaql\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • \Users\Admin\AppData\Local\Exception\dqaql\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • \Users\Admin\AppData\Local\Exception\dqaql\Default.exe

                        Filesize

                        1.2MB

                        MD5

                        64944a1f7d846006e04b6101d40a28b4

                        SHA1

                        139989bce70344cee6a009cbe197e43c263aa6a5

                        SHA256

                        311a3b7def97fc40fd72447b9e581401e5dcb7ecb6fc75e160035c87746452fa

                        SHA512

                        da01745a7bdefaaaa698d20b8c4c3f9a223dc49886d86560b42916f9b168249c54b6360ceebe18b5400f500247eafd8513c49cdc018995f7e770b3d775939dba

                      • memory/2376-2212-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2376-2213-0x0000000000BC0000-0x0000000000CF8000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2376-2214-0x000000001AE80000-0x000000001AF00000-memory.dmp

                        Filesize

                        512KB

                      • memory/2376-2215-0x0000000002100000-0x00000000021E2000-memory.dmp

                        Filesize

                        904KB

                      • memory/2376-2229-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2540-6-0x000000001B0E0000-0x000000001B1A8000-memory.dmp

                        Filesize

                        800KB

                      • memory/2540-7-0x0000000000150000-0x000000000019C000-memory.dmp

                        Filesize

                        304KB

                      • memory/2540-16-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2540-5-0x0000000000D50000-0x0000000000E18000-memory.dmp

                        Filesize

                        800KB

                      • memory/2540-4-0x000000001B000000-0x000000001B0E0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2540-3-0x000000001AB30000-0x000000001AC12000-memory.dmp

                        Filesize

                        904KB

                      • memory/2540-2-0x000000001B1B0000-0x000000001B230000-memory.dmp

                        Filesize

                        512KB

                      • memory/2540-1-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2540-0-0x00000000010F0000-0x0000000001228000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2648-4414-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2648-4413-0x000000001ADB0000-0x000000001AE30000-memory.dmp

                        Filesize

                        512KB

                      • memory/2648-2230-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2848-38-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-60-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-26-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-28-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-30-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-32-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-34-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-36-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-22-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-40-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-42-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-44-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-46-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-48-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-50-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-52-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-54-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-56-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-58-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-24-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-62-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-64-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-66-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-68-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-70-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-72-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-74-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-21-0x000000001B110000-0x000000001B1F0000-memory.dmp

                        Filesize

                        896KB

                      • memory/2848-20-0x000000001B090000-0x000000001B110000-memory.dmp

                        Filesize

                        512KB

                      • memory/2848-19-0x000007FEF4EB0000-0x000007FEF589C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2848-18-0x000000001B110000-0x000000001B1F4000-memory.dmp

                        Filesize

                        912KB

                      • memory/2848-14-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/2848-13-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

                        Filesize

                        4KB

                      • memory/2848-12-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/2848-10-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/2848-8-0x0000000000400000-0x00000000004AA000-memory.dmp

                        Filesize

                        680KB

                      • memory/2848-2203-0x0000000000140000-0x0000000000148000-memory.dmp

                        Filesize

                        32KB

                      • memory/2848-2204-0x00000000004B0000-0x0000000000506000-memory.dmp

                        Filesize

                        344KB

                      • memory/2848-2205-0x0000000000820000-0x0000000000874000-memory.dmp

                        Filesize

                        336KB

                      • memory/2848-2207-0x000007FEF4EB0000-0x000007FEF589C000-memory.dmp

                        Filesize

                        9.9MB